A stack-based buffer overflow vulnerability in Tenda AC7 firmware, version 15.03.06.44, poses a significant risk of remote code execution or system instability.

The vulnerability exists in the /goform/SetUpnpCfg endpoint, where the upnpEn POST parameter is stored without length validation. An attacker with low privileges can supply an oversized value that, when processed by the /goform/GetAdvanceStatus endpoint, results in a stack-based buffer overflow.

Successful exploitation of this vulnerability allows an attacker to cause a denial of service or potentially achieve remote code execution on the affected router. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could lead to full compromise of the device, enabling further lateral movement within the local network or the interception of sensitive traffic.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the Tenda support website for firmware updates addressing this issue and apply them immediately upon release.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at /goform/SetUpnpCfg or /goform/GetAdvanceStatus that contain unusually large payloads.

Compensating Controls: Deploy a Web Application Firewall or adjust network ingress rules to restrict access to the router management interface, ensuring it is not exposed to untrusted or public networks.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

This vulnerability presents a clear and present danger to Tenda AC7 deployments due to the availability of public proof-of-concept code. Organizations must prioritize segmenting these devices from the public internet and should actively check the Tenda product download portal for firmware updates to remediate the underlying memory corruption flaw as soon as a fix is available.