A critical buffer overflow vulnerability in the Tenda AC18 router allows remote attackers to execute arbitrary code or cause a system crash.

The vulnerability is a stack-based buffer overflow occurring in the HTTP Request Handler when the /goform/SetDlnaCfg endpoint processes the scanList parameter via an unsafe sprintf call. The vulnerability requires the attacker to have low privileges to interact with the configuration endpoint.

Successful exploitation of this memory corruption flaw can lead to full system compromise, allowing an attacker to execute arbitrary code with elevated privileges on the affected networking hardware. Given the CVSS score of 8.8, this poses a severe risk to network infrastructure, potentially enabling lateral movement, traffic interception, or complete denial of service for connected business operations.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the router management interface and disable the DLNA configuration features if they are not required.

Proactive Monitoring: Monitor device logs for unusual spikes in traffic directed at the /goform/SetDlnaCfg endpoint or unexpected device reboots that may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to inspect incoming HTTP requests and block payloads containing excessively long strings directed at the vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up provided in the references.

Due to the severity of this remote code execution flaw and the existence of a public proof-of-concept, users of the Tenda AC18 router must prioritize network-level segmentation to isolate the device. Organizations should verify if their firmware version is vulnerable and monitor vendor channels for the release of an official security patch to remediate this memory corruption issue.