A critical stack-based buffer overflow vulnerability in Tenda AC18 routers could allow remote attackers to achieve arbitrary code execution.

The vulnerability exists in the /goform/GetParentControlInfo endpoint, where the strcpy function fails to properly validate the length of the mac argument. This flaw allows an authenticated attacker to trigger a buffer overflow, potentially leading to system compromise.

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for potential remote code execution on network infrastructure. Successful exploitation could lead to full device takeover, allowing an attacker to intercept network traffic, pivot into internal segments, or render the device inoperable, causing significant operational downtime.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the management interface to trusted internal networks only. Contact Tenda support or check the official vendor website for firmware updates that address this memory corruption flaw.

Proactive Monitoring: Monitor device logs for unusual HTTP GET requests directed at the /goform/GetParentControlInfo endpoint, specifically those containing abnormally long strings in the mac parameter.

Compensating Controls: Implement a Web Application Firewall or network-based Access Control List to block requests to the vulnerable endpoint from unauthorized IP addresses until a firmware update is applied.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked research write-up by z472421519.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to network security. Organizations utilizing Tenda AC18 routers should prioritize isolating these devices from the public internet and verify firmware status with the vendor immediately to prevent unauthorized access.