CVE-2026-105778: Tenda AC5 Buffer Overflow Vulnerability

CVE-2026-105778 Overview

CVE-2026-105778 is a stack-based buffer overflow in the Tenda AC5 router running firmware version 02.03.01.111_multi. The flaw resides in the /goform/setWifi endpoint handled by the Wifi Handler component. Attackers manipulate the wifiPwd argument to overflow a fixed-size stack buffer. The condition is reachable over the network and the exploit has been publicly disclosed, lowering the barrier for weaponization. The weakness is classified under CWE-119, improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low privileges can corrupt stack memory on affected Tenda AC5 devices, enabling denial of service and potential arbitrary code execution on the router.

Affected Products

Tenda AC5 router, firmware 02.03.01.111_multi
Wifi Handler component exposing /goform/setWifi
Deployments where the router management interface is reachable from untrusted networks

Discovery Timeline

2026-10-06 - CVE-2026-105778 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105778

Vulnerability Analysis

The Tenda AC5 web management interface exposes the /goform/setWifi endpoint to configure wireless parameters. The handler copies the user-supplied wifiPwd parameter into a fixed-size stack buffer without validating input length. Supplying an oversized value overwrites adjacent stack memory, including saved return addresses and frame pointers. On MIPS-based Tenda firmware, this class of flaw typically allows attackers to redirect execution flow and achieve code execution on the device.

Successful exploitation runs in the context of the router's web service, which typically operates with elevated privileges on the embedded Linux system. Published proof-of-concept material is referenced in the GitHub Blog Post and tracked in the VulDB CVE-2026-105778 entry.

Root Cause

The root cause is missing bounds checking on the wifiPwd request parameter before it is written to a stack buffer in the Wifi Handler. The code trusts attacker-controlled length, which violates safe string handling and triggers the CWE-119 condition. Standard safeguards such as length validation, bounded copies, and stack canaries are either absent or ineffective in the vulnerable build.

Attack Vector

The attack vector is network-based. An authenticated attacker with low privileges issues a crafted HTTP POST request to /goform/setWifi with an oversized wifiPwd field. In deployments where the management interface is exposed to the WAN or where attackers already have access to the LAN, the request can be delivered directly. Chaining with cross-site request forgery against an authenticated administrator is also plausible given the HTTP-driven handler.

No verified exploit code is reproduced here. See the referenced VulDB Vulnerability #413811 record and the public GitHub Blog Post for technical details on triggering the overflow.

Detection Methods for CVE-2026-105778

Indicators of Compromise

HTTP POST requests to /goform/setWifi containing abnormally long wifiPwd parameter values
Unexpected reboots, watchdog-triggered restarts, or httpd process crashes on Tenda AC5 devices
New or modified administrative accounts and configuration changes following suspicious management-interface traffic
Outbound connections from the router to unfamiliar hosts, indicative of post-exploitation implants

Detection Strategies

Inspect network traffic for POST requests to /goform/setWifi where parameter length exceeds expected password bounds, typically 64 bytes
Correlate router log entries for Wifi Handler errors with inbound HTTP sessions from untrusted sources
Deploy signatures on perimeter IDS/IPS to flag oversized form fields targeting Tenda /goform/ endpoints

Monitoring Recommendations

Forward router syslog and management-plane access logs to a centralized analytics platform for retention and correlation
Baseline normal administrative traffic patterns to the router and alert on deviations in source IP, user agent, or request size
Monitor WAN-side access attempts to the HTTP management interface and alert when it is reachable from the internet

How to Mitigate CVE-2026-105778

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs only
Disable WAN-side administration on all affected Tenda AC5 devices running firmware 02.03.01.111_multi
Rotate administrative credentials and enforce strong, unique passwords to reduce the risk of authenticated exploitation
Audit router configurations for unauthorized changes following any suspected exposure

Patch Information

At publication, no vendor-supplied patch is referenced in the NVD entry for CVE-2026-105778. Consult the Tenda Official Website for firmware updates and advisories. Until a fixed firmware release is available, apply the compensating controls listed above.

Workarounds

Place vulnerable Tenda AC5 devices behind an upstream firewall that blocks inbound access to the HTTP management port
Segment IoT and management networks so that only administrative hosts can reach /goform/ endpoints
Replace end-of-support or unpatched devices with current hardware that receives timely security updates

bash

# Example: block external access to the Tenda web UI from an upstream Linux gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_interface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_interface> -j DROP