A critical stack-based buffer overflow vulnerability in Tenda AX1803 firmware allows remote, authenticated attackers to achieve code execution or system crashes.

The vulnerability exists within the formSetWifiMacFilterCfg function in the /goform/setWifiFilterCfg endpoint, where the deviceList parameter is passed to a strcpy operation without proper bounds checking. Per the CVSS vector (PR:L), this attack requires low-level privileges, meaning a logged-in user can trigger the memory corruption.

The vulnerability poses a severe risk to network integrity and availability. Successful exploitation can result in full system compromise, allowing an attacker to execute arbitrary code with the privileges of the web service, or cause persistent denial of service conditions. With a CVSS score of 8.8, this flaw represents a significant security risk to any organization relying on these devices for secure network traffic management.

Immediate Action: Monitor the vendor support portal for a firmware update that addresses the buffer overflow in the setWifiFilterCfg function. If no patch is currently available, restrict access to the administrative interface to trusted management IP addresses only.

Proactive Monitoring: Review system logs for anomalous requests to the /goform/setWifiFilterCfg endpoint, particularly those containing unusually large payloads in the deviceList parameter.

Compensating Controls: Deploy a Web Application Firewall or network intrusion prevention system to inspect traffic directed at the router's web interface and block requests containing oversized or malformed parameters.

Public Exploit Available: Yes, a published proof-of-concept exists (attributed to the technical write-up provided in the research references).

Given the availability of a public proof-of-concept and the high severity of the vulnerability, administrators must treat this as an urgent priority. Until a vendor-supplied patch is installed, ensure that the device management interface is not exposed to the public internet and limit access to authorized internal personnel to prevent exploitation by malicious actors.