A stack-based buffer overflow in the Tenda AC15 router firmware allows for potential remote code execution or system denial-of-service.

The vulnerability exists due to a lack of length validation when processing the newVersion parameter during a POST request to /goform/setNotUpgrade. An authenticated attacker can supply a malicious string that overflows a stack buffer during subsequent retrieval of the configuration value, leading to memory corruption.

Successful exploitation of this flaw can result in a complete loss of availability for the network device, causing significant downtime for connected services. Furthermore, if the attacker successfully achieves arbitrary code execution, they could gain full control over the router, potentially facilitating man-in-the-middle attacks or unauthorized access to the internal network. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk to operational continuity and network security.

Immediate Action: Since no official patch is currently available, users should restrict administrative access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor device logs for unexpected reboots or crashes that coincide with requests to the /goform/setNotUpgrade or /goform/GetRouterStatus endpoints.

Compensating Controls: Implement strict network segmentation to ensure the router management interface is not exposed to the public internet or untrusted users.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up on GitHub.

Given the availability of a public proof-of-concept and the high potential for remote code execution, this vulnerability poses a significant risk to affected Tenda AC15 deployments. Administrators must isolate the affected devices from external networks immediately and monitor vendor support channels for the release of a firmware update to permanently resolve this memory corruption issue.