A critical stack-based buffer overflow vulnerability in Tenda AC6 routers poses a significant risk of remote code execution for affected devices.

This vulnerability is a stack-based buffer overflow located in the HTTP request handler for the /goform/WifiGuestSet endpoint. An authenticated attacker can trigger the memory corruption by sending a malformed request containing an excessively long shareSpeed parameter value.

Successful exploitation of this vulnerability allows a remote attacker to gain control over the affected router, potentially leading to unauthorized network access, data interception, or complete system compromise. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate lateral movement into protected internal networks. Organizations relying on these devices for network infrastructure face potential service disruption and compromise of sensitive traffic.

Immediate Action: As no official patch is currently identified, verify if the manufacturer has released updated firmware versions and apply them immediately. If no update is available, restrict management access to the device to trusted internal interfaces only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests directed at the /goform/WifiGuestSet endpoint, specifically looking for unusually large payloads in the shareSpeed parameter.

Compensating Controls: Implement network segmentation to isolate the management interfaces of networking hardware from general user traffic and utilize a firewall to block unauthorized remote access to the router web interface.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the research repository provided by the vulnerability reporter.

The presence of a public proof-of-concept increases the likelihood of exploitation by malicious actors. Administrators must prioritize isolating these devices from external exposure immediately. If firmware updates are not provided by the vendor, consider replacing the affected hardware with a supported and patched alternative to eliminate the risk of remote compromise.