https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4906.htmlhttps://patchthecve.com/cve/CVE-2026-4906.htmlWed, 17 Jun 2026 10:57:25 +0000HIGH 8.8: A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remothttps://patchthecve.com/cve/CVE-2026-4905.htmlhttps://patchthecve.com/cve/CVE-2026-4905.htmlWed, 17 Jun 2026 10:57:25 +0000HIGH 8.8: A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsOOB of the component POST Request Handler. Performing a manipulation of the argument index results in stack-based buffer overflow. Remote exploitation of the attack is possible. Thehttps://patchthecve.com/cve/CVE-2026-4904.htmlhttps://patchthecve.com/cve/CVE-2026-4904.htmlWed, 17 Jun 2026 10:57:25 +0000HIGH 8.8: A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit hashttps://patchthecve.com/cve/CVE-2026-4903.htmlhttps://patchthecve.com/cve/CVE-2026-4903.htmlWed, 17 Jun 2026 10:57:25 +0000HIGH 8.8: A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer overflow. The attack may be initiated remotely. The ehttps://patchthecve.com/cve/CVE-2026-4902.htmlhttps://patchthecve.com/cve/CVE-2026-4902.htmlWed, 17 Jun 2026 10:57:25 +0000HIGH 8.8: A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now