A critical buffer overflow vulnerability in Tenda AC20 routers allows remote, authenticated attackers to crash the device or execute arbitrary code.

The flaw exists in the strcpy function within the /goform/GetParentControlInfo handler. An attacker can supply a specially crafted mac parameter in an HTTP POST request to trigger a stack-based buffer overflow, requiring low-privileged user access to initiate.

Successful exploitation of this vulnerability could lead to a complete compromise of the router, allowing for unauthorized code execution or persistent denial of service. Given the CVSS score of 8.8, this poses a significant risk to network availability and data integrity, potentially providing an attacker with a foothold to conduct further lateral movement within the local network.

Immediate Action: Check the Tenda support website for firmware updates addressing this buffer overflow and apply them immediately. If no patch is currently available for your specific build, restrict access to the device management interface.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at the /goform/GetParentControlInfo endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network access control list to restrict management access to the router to known, trusted internal IP addresses only.

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Due to the severity of this remote code execution vulnerability and the availability of a public proof-of-concept, users must prioritize securing their Tenda AC20 devices. If a firmware update is not yet available, immediately disable remote management features and restrict administrative access to the device to prevent unauthorized exploitation.