A critical buffer overflow vulnerability in Tenda AC20 routers allows remote, authenticated attackers to achieve arbitrary code execution, necessitating immediate network segmentation or firmware updates.

This vulnerability is a buffer overflow triggered by improper handling of the startIp argument within the /goform/SetPptpServerCfg endpoint. The flaw exists in the strcpy function of the HTTP POST request handler, which can be exploited by an authenticated user to overwrite memory and potentially execute code.

A successful exploitation of this vulnerability could lead to a total compromise of the affected router, granting an attacker full control over network traffic. Given the CVSS score of 8.8, the business impact includes potential data interception, unauthorized access to internal network segments, and significant operational disruption of network services.

Immediate Action: Check the Tenda support website for the latest firmware release for the AC20 and update all affected devices to a version exceeding 16.03.08.12.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/SetPptpServerCfg endpoint and watch for signs of unauthorized configuration changes or unexpected service restarts.

Compensating Controls: If a patch is not yet available, restrict administrative access to the router management interface to trusted IP addresses only and disable remote management features to reduce the attack surface.

Public Exploit Available: Yes, a public proof-of-concept is available via the referenced GitHub repository.

The severity of this buffer overflow, combined with the availability of a public proof-of-concept, presents a high risk to network security. Administrators should prioritize identifying vulnerable AC20 units within their environment and apply vendor-supplied firmware updates as soon as they become available to prevent potential remote code execution.