A critical stack-based buffer overflow vulnerability in the Tenda AC18 router could allow remote attackers to execute arbitrary code or cause a system crash.

This is a stack-based buffer overflow (CWE-121) occurring in the /goform/SetUpnpCfg endpoint. By sending a specially crafted POST request containing an excessively long upnpEn parameter, a remote, authenticated attacker can trigger memory corruption, potentially leading to remote code execution.

The CVSS score of 8.8 indicates a high severity risk that could lead to full compromise of the affected routing hardware. Successful exploitation allows an attacker to gain control over network traffic, potentially intercepting sensitive data, launching man-in-the-middle attacks, or pivoting into the internal network, which poses a significant threat to organizational confidentiality and integrity.

Immediate Action: Since a specific vendor patch is not currently available, administrators should immediately restrict access to the web management interface of the Tenda AC18 router to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for abnormal crashes or restarts, and inspect network traffic for unusually large POST requests directed at the /goform/SetUpnpCfg endpoint.

Compensating Controls: If possible, place the affected device behind a firewall that inspects and filters traffic to the management interface, blocking requests that contain anomalous payload lengths for the upnpEn parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by the vulnerability reporter.

Given the remote execution potential and the availability of public exploit code, this vulnerability represents a significant risk to network infrastructure. Administrators must prioritize isolating these devices from external access until the manufacturer releases a firmware update that addresses the lack of length validation in the SetValue function.