A critical stack-based buffer overflow vulnerability in Tenda M3 routers allows remote attackers with low-level access to trigger memory corruption and potential code execution.

The vulnerability exists in the formSetRemoteVlanInfo function within the /goform/setVlanInfo handler, which fails to perform bounds checking on the ID, vlan, and port parameters. An authenticated attacker can trigger this overflow by sending a crafted HTTP POST request to the device.

The CVSS score of 8.8 indicates a high-severity risk that could lead to full system compromise. Successful exploitation allows for the execution of arbitrary code with elevated privileges, potentially resulting in unauthorized network access, data exfiltration, or complete loss of router availability. The ability to perform this attack remotely increases the risk profile for distributed environments.

Immediate Action: Update the affected Tenda M3 firmware to the latest version provided by the manufacturer. If a patch is not yet available for this specific build, isolate the management interface from untrusted networks.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed toward the /goform/setVlanInfo endpoint, particularly those containing excessively long strings in the ID, vlan, or port parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block malformed packets targeting the Tenda administrative web interface.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up by the researcher.

Given the availability of a functional proof-of-concept and the high CVSS severity, administrators should prioritize patching the Tenda M3 device immediately. If patching is not feasible, ensure that the administrative interface is strictly restricted to authorized management subnets to prevent remote exploitation by unauthorized actors.