A critical stack-based buffer overflow vulnerability in Tenda AC18 routers permits remote attackers to achieve arbitrary code execution via a specially crafted POST request.

This vulnerability involves a stack-based buffer overflow within the /goform/setNotUpgrade endpoint, triggered when the newVersion parameter is manipulated. The issue stems from a lack of length validation during the processing of configuration variables, which can be exploited by an authenticated user with low privileges to corrupt memory and potentially execute arbitrary code.

A successful exploitation of this vulnerability could lead to a total compromise of the affected router, allowing attackers to intercept network traffic, modify DNS settings, or pivot into the internal network. Given the CVSS score of 8.8, this represents a high-severity risk that could result in significant data breaches and persistent unauthorized access to infrastructure. Organizations relying on these devices for network security or connectivity face immediate operational and security threats until the vulnerability is addressed.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the management interface of affected Tenda AC18 devices to trusted internal management networks only.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /goform/setNotUpgrade endpoint, specifically looking for abnormally large inputs in the newVersion parameter.

Compensating Controls: Implement firewall rules to block external access to the device management interface, effectively preventing remote exploitation attempts.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at GitHub.

The presence of a functional proof-of-concept and the potential for remote code execution make this a significant security risk for any environment utilizing Tenda AC18 hardware. Organizations must prioritize segmenting these devices from exposed network segments and actively monitor for unauthorized configuration changes. Until the vendor releases a firmware update, the removal of remote administrative access is the most effective mitigation strategy to prevent potential compromise.