A stack-based buffer overflow vulnerability (CVE-2026-4905) was discovered in Tenda AC5 router firmware version 15.03.06.47. The vulnerability exists in the formWifiWpsOOB function of the /goform/WifiWpsOOB file within the POST Request Handler component. An attacker can trigger the vulnerability by manipulating the 'index' argument, leading to a stack-based buffer overflow. The vulnerability can be exploited remotely, and public exploits are already available. This poses a significant security risk to affected Tenda AC5 routers as attackers can potentially execute arbitrary code or cause denial of service.