A critical buffer overflow vulnerability in Tenda M3 firmware allows remote attackers to execute arbitrary code or cause a denial of service on affected devices.

This vulnerability is a stack-based buffer overflow occurring within the formSetAdPushInfo function of the /goform/setAdPushInfo endpoint. An attacker with low privileges can trigger this memory corruption by sending crafted input via the mac or terminal parameters, which lack sufficient bounds checking.

Successful exploitation of this vulnerability could lead to full system compromise, allowing an attacker to execute arbitrary code with elevated privileges or crash the device, resulting in significant operational downtime. With a CVSS score of 8.8, this flaw represents a high-severity risk to network infrastructure stability and data integrity, particularly for environments relying on these access points for secure connectivity.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management interface of the Tenda M3 device to trusted management subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/setAdPushInfo endpoint and review system logs for signs of anomalous crash events or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long strings sent to the mac or terminal parameters within HTTP POST requests.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the researcher write-up at the provided GitHub repository.

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a severe threat to Tenda M3 devices. Organizations should prioritize isolating these devices from external network segments and maintain heightened vigilance until the vendor releases a firmware update that addresses the memory corruption issue.