CVE-2026-105778

Executive Summary

CVE-2026-105778 is a stack-based buffer overflow in the Tenda AC5 wireless router firmware version 02.03.01.111_multi, reachable through the /goform/setWifi endpoint in the Wifi Handler component. An attacker can trigger the flaw by supplying an oversized value to the wifiPwd argument, resulting in memory corruption. With a CVSS base score of 9.9 (Critical scope-Changed), the vulnerability enables remote compromise of confidentiality, integrity, and availability. No vendor patch, workaround, or OSV package mapping is available, and the exploit has been publicly disclosed.

Technical Analysis

The affected device is the Tenda AC5 router running firmware 02.03.01.111_multi. The vulnerable code path is exposed via the HTTP management endpoint /goform/setWifi, which is handled by the Wifi Handler component. Per the NVD description, the specific function is not named; only the endpoint and the vulnerable argument are identified.

The vulnerability class is a stack-based buffer overflow (CWE-119, with the classical root cause being CWE-121). The wifiPwd parameter is copied into a fixed-size stack buffer in the Wifi Handler without adequate bounds validation. When the length of the supplied password value exceeds the destination buffer capacity, adjacent stack memory — including saved control data such as the saved return address or saved frame pointer — is overwritten. The result is memory corruption that, depending on stack layout and protections present in the firmware binary, can be leveraged for denial of service (crash/reboot) or, more seriously, arbitrary code execution in the context of the device's web management daemon.

Attack surface: the /goform/setWifi form handler is part of the router's embedded HTTP administration interface. The CVSS vector indicates AV:N (remotely exploitable over the network) and PR:L (low privileges required), consistent with an attacker who has already obtained a low-privileged session on the management interface, or with the router's authentication model in which the web UI is reachable without full administrative credentials. Scope is marked Changed (S:C), reflecting the transition from the web-management component to the wider firmware/OS context when memory is corrupted. UI:N confirms no user interaction is required.

No public exploit code or Nuclei template is tracked here, but the NVD description states the exploit has been disclosed to the public and may be used. No function names or additional parameters beyond /goform/setWifi and wifiPwd are asserted, as the source data does not provide them.

Exploitation Scenarios

No public PoC is available in the tracked sources; the attack chain below is inferred from the vulnerability class (stack-based buffer overflow reachable via a remote form handler).

1. Reconnaissance / target identification: The attacker scans for exposed Tenda AC5 management interfaces (typically TCP/80 or TCP/443 on the LAN/WAN-facing interface, or via Shodan using the dorks above). Banner, web title, or the presence of /goform/setWifi as a form action identifies a candidate device. Firmware version 02.03.01.111_multi is confirmed via the device's status/version page or by probing known form handlers.

2. Triggering the flaw: The attacker issues an HTTP POST to /goform/setWifi with a wifiPwd argument whose value is longer than the receiving stack buffer in the Wifi Handler. Because the argument is copied into a fixed-size stack buffer without bounds checking, the excess bytes overwrite adjacent stack memory. The low-privilege requirement (PR:L) implies a valid or partially valid session is needed, but the check is weak enough that a low-privileged context suffices.

3. Payload/execution method: At the vulnerability-class level, the attacker crafts a payload that (a) demonstrates overflow control (crash/DoS) or (b) places a controlled overflow payload to redirect execution. Any concrete ROP chain, bad-character set, or offset would be firmware- and build-specific and is not derivable from the provided description; those exact details are not asserted here.

4. Post-exploitation impact: Successful exploitation yields code execution or full control of the router's management process, enabling configuration tampering (DNS/hijack, credential change), traffic interception or redirection, persistence on the device, and use of the router as a pivot into the internal network. Even a failed exploit path causes device reboot or instability, denying service to attached hosts.

Impact Assessment

The CVSS v3.1 base score is 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Interpretation of subscores:

• AV:N (Network): the /goform/setWifi handler is reachable over the network, not limited to local physical access.
• AC:L (Low): no special conditions beyond sending a crafted request are required.
• PR:L (Low): a low-privileged context is sufficient; the attacker does not need full administrative rights.
• UI:N (None): no victim interaction is needed.
• S:C (Changed): corruption of the Wifi Handler process can affect resources beyond the vulnerable component, i.e., the wider system.
• C:H / I:H / A:H: complete loss of confidentiality, integrity, and availability of the device.

Blast radius: any Tenda AC5 running firmware 02.03.01.111_multi that exposes its management interface. In SOHO, retail, and small-branch deployments, the router is the network boundary; its compromise exposes every downstream host to interception, redirection, and lateral movement. There is no CISA KEV listing and no EPSS score is yet assigned, but the confirmed public disclosure raises the near-term likelihood of opportunistic scanning and exploitation. Because the issue is UNPATCHED with no vendor workaround, every internet- or LAN-exposed AC5 at this firmware level is at risk until the device is replaced, isolated, or compensated through network segmentation.

Detection Guidance

Sigma Rule

title: Tenda AC5 setWifi wifiPwd Stack Buffer Overflow Attempt
id: 8f3a1c2e-4b7d-4e91-9c55-0a6d2f7b1e44
status: experimental
description: Detects HTTP POST requests to /goform/setWifi with an oversized wifiPwd argument indicative of CVE-2026-105778 stack buffer overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105778
author: valtersit.com
logsource:
  category: webserver
  product: tenda
detection:
  selection_uri:
    cs-uri-stem|endswith: '/goform/setWifi'
  selection_method:
    cs-method: 'POST'
  selection_body:
    cs-uri-query|contains: 'wifiPwd='
  condition: selection_uri and selection_method and selection_body
  # Correlate with proxy/IDS byte-length telemetry: flag bodies where the
  # wifiPwd value length exceeds expected password lengths.
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate configuration changes with unusually long WiFi passwords
level: high

YARA Rule

rule CVE_2026_105778_Tenda_AC5_setWifi_Exploit
{
    meta:
        description = "Detects payloads targeting the Tenda AC5 /goform/setWifi wifiPwd stack buffer overflow (CVE-2026-105778)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105778"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $a = "/goform/setWifi" ascii wide nocase
        $b = "wifiPwd=" ascii wide nocase
        $c = "POST /goform/setWifi" ascii wide nocase

    condition:
        (uint16(0) == 0x504F or uint16(0) == 0x0A0D or true) and
        $a and $b
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105778 Tenda AC5 setWifi wifiPwd Stack Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/setWifi"; http.request_body; content:"wifiPwd="; pcre:"/wifiPwd=[^&\s]{128,}/Ri"; reference:cve,2026-105778; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105778; classtype:attempted-admin; sid:2026105778; rev:1;)

Note: the 128-byte threshold is a conservative detection heuristic for an oversized password field; tighten or loosen based on observed benign password lengths in the target environment.

Elastic Detection

network where
  http.request.method == "POST" and
  http.request.uri like "*/goform/setWifi*" and
  http.request.body.text like "*wifiPwd=*" and
  length(http.request.body.text) > 256

Splunk SPL Query

index=proxy OR index=web OR index=ids
| where match(lower(uri), "/goform/setwifi") AND match(lower(method), "post")
| eval pwd_len = len(mvindex(split(body, "wifiPwd="), 1))
| where pwd_len > 128 OR isnull(pwd_len)
| table _time, src_ip, dest_ip, method, uri, pwd_len, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,tenda,cve-2026-105778,">
  <rule id="1057780" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/goform/setWifi</match>
    <description>CVE-2026-105778: POST to Tenda AC5 /goform/setWifi - possible wifiPwd stack buffer overflow attempt</description>
    <options>no_full_log</options>
  </rule>
  <rule id="1057781" level="13">
    <if_sid>1057780</if_sid>
    <regex>wifiPwd=</regex>
    <description>CVE-2026-105778: Oversized wifiPwd argument submitted to /goform/setWifi</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor firmware fix, workaround, or OSV package mapping is currently available. Treat any internet- or LAN-exposed Tenda AC5 at 02.03.01.111_multi as vulnerable.

1. Immediate mitigations:

• Remove management-plane exposure: disable remote/WAN web administration on the AC5 and, if the firmware permits, restrict the web UI to a trusted management VLAN. Enforce firewall rules so that TCP/80 and TCP/443 toward the /goform/setWifi handler are reachable only from administrative hosts.
• Place the router behind a managed firewall and segment the WLAN/LAN from sensitive segments. Block inbound HTTP(S) to the device from untrusted zones.
• Deploy the Suricata, Sigma, Splunk, Elastic, and Wazuh rules above to monitor for POST requests to /goform/setWifi with an oversized wifiPwd argument.
• Enforce administrative authentication on the web UI where the firmware allows it; change default credentials (PR:L implies a low-privileged context is sufficient, so weak/default sessions materially raise risk).
• If the device cannot be isolated, replace it with a model under active vendor support.

2. Patch/upgrade steps:

• No patch is available from the tracked sources. Monitor the Tenda support/download portal for AC5 firmware releases newer than 02.03.01.111_multi and NVD for an updated CVE record. If a fixed firmware is released, back up the configuration, apply the upgrade, and re-validate the /goform/setWifi handler after the update.
• Where the device is not field-upgradable or is end-of-life, plan replacement.

3. Long-term hardening:

• Maintain an inventory of all edge/SOHO routers and track firmware versions against NVD/CVE feeds; subscribe to vendor security advisories.
• Adopt network segmentation with default-deny rules between the router management plane and user subnets.
• Harden the management interface (disable WAN management, strong unique admin credentials, disable unused services such as telnet/UPnP if exposed).
• Test firmware updates in a lab before production rollout due to the router's boundary role, and maintain an offline configuration backup to enable rapid recovery after a compromise.
• Continuously monitor for public exploit publication for CVE-2026-105778 and re-prioritize as an emergency change given the current UNPATCHED status.

References

• NVD — CVE-2026-105778: https://nvd.nist.gov/vuln/detail/CVE-2026-105778
• MITRE CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Tenda support/download portal (vendor advisories and firmware): https://www.tenda.com.cn/
• CISA KEV Catalog (no listing for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaign or confirmed in-the-wild exploitation specific to CVE-2026-105778 is documented in the provided data. The NVD description states the exploit has been disclosed to the public and may be used; no public PoC repository, Nuclei template, or Metasploit module is tracked. CISA KEV status: NOT listed. EPSS: not yet scored by FIRST.org.