A stack overflow vulnerability in the Tenda AX-1806 router enables unauthenticated attackers to cause a denial of service condition.

The device contains a stack overflow vulnerability within the fromSetSysTime function, specifically triggered through the timeZone parameter. This flaw is exploitable by an unauthenticated attacker sending a crafted network request to the device.

The successful exploitation of this vulnerability results in a denial of service, rendering the affected networking hardware unresponsive. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to business continuity by potentially disrupting network connectivity for all users reliant on the device. Unauthenticated remote access makes this an easily reachable target for attackers seeking to cause operational instability.

Immediate Action: Since no official patch is currently identified, restrict management interface access to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for frequent service restarts or unusual traffic patterns directed toward system time configuration endpoints.

Compensating Controls: Deploy firewall rules to block unsolicited inbound traffic to the device management interface, effectively isolating the vulnerable function from external reach.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced in the CVE record.

The presence of a functional proof-of-concept combined with the lack of an available vendor patch necessitates immediate defensive action. Administrators should prioritize network segmentation or firewall configuration to isolate the vulnerable router until the vendor provides a firmware update to address the stack overflow.