An unauthenticated remote denial of service vulnerability in the Tenda AC6 router poses a significant risk to network availability.

This vulnerability is a buffer overflow condition affecting the formSetCfm function, which can be reached via the SetCfm URI path. An unauthenticated attacker can exploit this by sending malicious input to the funcname, funcpara1, or funcpara2 parameters.

Successful exploitation of this vulnerability results in a denial of service, rendering the affected network device unresponsive and potentially requiring a manual power cycle to restore connectivity. With a CVSS score of 7.7, this flaw represents a high risk to business operations, as it could be used to disrupt critical network infrastructure or internal communications platforms.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the device management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the SetCfm URI path and look for unexpected device reboots or log entries indicating service crashes.

Compensating Controls: Deploy firewall rules to block external access to the device web interface and consider placing the management interface on a isolated management VLAN.

Public Exploit Available: Yes, a technical proof of concept is available via the researcher write-up linked in the reference section.

Given the public availability of technical details regarding this exploit, Tenda AC6 users must prioritize securing the management interface of their devices. While a formal firmware patch is awaited, implementing strict network segmentation and limiting administrative access is essential to prevent potential disruption to business operations.