A critical stack overflow vulnerability in Tenda TX9 firmware allows unauthenticated attackers to achieve remote code execution, posing a severe risk to network integrity.

This is a stack overflow vulnerability located in the sub_4418CC function of the /goform/SetNetControlList file. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The vulnerability carries a CVSS score of 9.8, signifying a critical severity level. Successful exploitation allows an attacker to execute arbitrary code with elevated privileges on the device, potentially leading to a full compromise of the router, interception of network traffic, or use of the device as a pivot point for further attacks on the internal network.

Immediate Action: Users should immediately check the Tenda support website for firmware updates and apply the latest available version. If no patch is currently available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for unusual patterns directed at the /goform/SetNetControlList endpoint and review device logs for signs of unauthorized access or service crashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures capable of identifying and blocking malformed requests targeting the SetNetControlList function.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the provided technical documentation.

Given the critical nature of this remote code execution vulnerability and the availability of proof-of-concept material, immediate attention is required. Administrators should prioritize updating the firmware on all affected Tenda TX9 devices. If updates cannot be applied immediately, ensure the management interface is not exposed to the public internet to mitigate the risk of unauthenticated exploitation.