A critical stack-based buffer overflow vulnerability in the Tenda AC21 router, specifically in the time parameter of the SetSysTimeCfg function, poses a risk of remote code execution or denial of service.

This vulnerability is a stack-based buffer overflow occurring in the fromSetSysTime function within the httpd binary. It is triggered via the time parameter of the /goform/SetSysTimeCfg endpoint, and it requires low-level privileges to initiate.

Successful exploitation of this buffer overflow allows an attacker to cause a denial of service or potentially achieve remote code execution on the affected router. Given the CVSS score of 8.8, this vulnerability represents a high risk to network integrity and availability, as it could allow unauthorized control over gateway hardware, leading to lateral movement or total loss of network security.

Immediate Action: As no patch is currently available, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /goform/SetSysTimeCfg endpoint, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an intrusion detection system (IDS) to filter malicious input strings directed at the vulnerable time parameter.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher write-up published on GitHub.

Given the high severity of this vulnerability and the availability of public proof-of-concept code, users should treat this issue with high urgency. If the vendor does not provide a firmware update, consider replacing the affected hardware or isolating it from all untrusted networks to prevent unauthorized remote access.