A critical stack-based buffer overflow vulnerability in Tenda AC7 routers permits remote code execution, posing a significant risk to network integrity.

This vulnerability is a stack-based buffer overflow caused by improper handling of the deviceList argument within the formSetMacFilterCfg function of the httpd component. The flaw is exploitable remotely by an authenticated user, leading to potential memory corruption and system compromise.

The CVSS score of 8.8 reflects the high severity of this vulnerability, as it allows for unauthorized remote control of networking hardware. Successful exploitation could lead to full device compromise, enabling attackers to intercept traffic, pivot into internal networks, or disrupt critical business communication services.

Immediate Action: Since no specific patch version is currently identified, users should restrict administrative access to the web interface to trusted management networks only. Disable remote management features if they are not strictly required for operations.

Proactive Monitoring: Monitor device logs for recurring httpd service crashes or unusual traffic patterns directed at the /goform/setMacFilterCfg endpoint.

Compensating Controls: Implement a Web Application Firewall or network access control list to filter traffic directed at the router management interface, specifically blocking suspicious payloads targeting the deviceList parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced researcher write-up.

Given the remote exploitability and the existence of a public proof-of-concept, this vulnerability poses a severe risk to Tenda AC7 deployments. Administrators must prioritize isolating affected devices from the public internet and await official firmware updates from the vendor to remediate the underlying memory corruption flaw.