A critical stack overflow vulnerability in Tenda TX9 firmware allows unauthenticated attackers to execute arbitrary code or cause a system crash.

This is a stack overflow vulnerability occurring in the sub_424CE0 function when processing requests to the /goform/setMacFilterCfg endpoint. The flaw is triggered by unauthenticated network attackers sending crafted HTTP requests, which exploit missing length validation to overflow a stack buffer.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Successful exploitation could allow an attacker to gain complete control over the affected router, facilitating unauthorized access to internal network traffic, data exfiltration, or complete service disruption for all connected clients.

Immediate Action: Consult the official Tenda support website to determine if a patched firmware version is available for the TX9 device and apply it immediately.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests directed at the /goform/setMacFilterCfg endpoint and review system logs for signs of unexpected device reboots or process crashes.

Compensating Controls: Deploy a network-level firewall or an Intrusion Prevention System (IPS) to filter malicious traffic and restrict access to the device management interface from untrusted networks.

Public Exploit Available: Yes, a public proof-of-concept is available via external research repositories.

Given the critical CVSS score and the existence of public proof-of-concept material, this vulnerability poses a significant risk to network security. Administrators should prioritize identifying vulnerable devices and applying manufacturer-provided security updates or isolating affected systems from the internet to prevent exploitation.