A heap-based buffer overflow vulnerability in Tenda M3 devices allows remote attackers to execute arbitrary code or cause a system crash through improper input validation.

This is a heap-based buffer overflow (CWE-122) occurring in the formSetAdInfoDetails function of the /goform/setAdInfoDetail endpoint. An authenticated attacker can trigger this memory corruption by sending specially crafted POST requests containing overly long values for parameters such as adName or smsPassword, as the application fails to perform necessary bounds checking before memory allocation and copying.

The exploitation of this vulnerability can lead to a complete compromise of the affected Tenda M3 device, granting an attacker the ability to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this represents a high-severity risk that could result in unauthorized network access, data interception, or the total denial of service for critical network infrastructure managed by the affected hardware.

Immediate Action: Since a specific patch is not currently available, administrators should restrict access to the administrative interface and the /goform/setAdInfoDetail endpoint to trusted management IP addresses only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/setAdInfoDetail endpoint, specifically looking for unusually large payloads in the specified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming requests containing excessively long strings in the identified vulnerable parameters.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up provided by the researcher.

Due to the high CVSS severity and the existence of a public proof-of-concept, this vulnerability poses a significant risk to Tenda M3 deployments. Organizations should prioritize isolating these devices from the public internet immediately and monitor vendor communication channels closely for the release of an official firmware update to address this memory corruption flaw.