A critical stack-based buffer overflow in Tenda AC15 routers allows remote attackers to trigger device crashes or potential arbitrary code execution.

The vulnerability is a stack-based buffer overflow triggered by sending an oversized string to the ddnsEn parameter in the POST /goform/SetDDNSCfg endpoint. The system lacks sufficient bounds checking when storing and retrieving this configuration data, allowing an authenticated attacker to overwrite the stack buffer.

The exploitation of this vulnerability can lead to a complete denial of service by causing the router to crash or reboot, resulting in significant network downtime for organizations relying on the device. Furthermore, if an attacker successfully achieves arbitrary code execution, they could gain persistent access to the internal network, potentially facilitating lateral movement or data exfiltration. Given the CVSS score of 8.8, this represents a high-risk security flaw that requires immediate attention.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the router management interface and disable DDNS features if they are not strictly required.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/SetDDNSCfg endpoint and review system logs for recurring device reboots or unexpected process terminations.

Compensating Controls: Deploy a Web Application Firewall or network-level intrusion detection system to inspect incoming traffic for abnormally long strings within the ddnsEn parameter field.

Public Exploit Available: Yes, a functional proof-of-concept has been published in a security research repository.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe threat to network infrastructure. Administrators should prioritize the hardening of affected Tenda devices and actively monitor for vendor security updates. Until a firmware patch is released and applied, isolating the management interface from the public internet is the most effective strategy to mitigate the risk of unauthorized exploitation.