CVE-2026-5830

CVE-2026-5830 is a stack-based buffer overflow vulnerability in Tenda AC15 router firmware version 15.03.05.18, specifically within the websGetVar function of the /goform/SysToolChangePwd endpoint. The vulnerability can be exploited by manipulating the oldPwd, newPwd, or cfmPwd parameters to trigger memory corruption. The vulnerability carries a HIGH CVSS score of 8.8, with a network-based attack vector requiring low complexity and low privileges. An authenticated attacker can remotely exploit this flaw without user interaction to achieve complete compromise of system confidentiality, integrity, and availability. The EPSS score of 0.0004800 indicates this is among the less frequently targeted vulnerabilities community-wide. While public exploit code is available, the vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The moderate FAUCET Risk Score of 51.0 and inactive status on community hot lists suggest limited immediate threat activity, though organizations running affected Tenda AC15 devices should prioritize firmware updates to mitigate the remote code execution risk.