A critical stack-based buffer overflow vulnerability in Tenda AC23 routers could allow remote attackers to achieve unauthorized code execution.

This memory corruption vulnerability originates in the sub_46C940 function within the /goform/setMacFilterCfg endpoint of the httpd component. The flaw allows an attacker to trigger a stack-based buffer overflow via the deviceList argument, which requires low privileges to execute.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for system compromise. Successful exploitation could lead to full loss of router control, enabling attackers to intercept network traffic, redirect users to malicious sites, or use the device as a persistent foothold within the internal network.

Immediate Action: Contact Tenda support or check the official vendor website for firmware updates that address this buffer overflow, as no official patch version is currently identified.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the /goform/setMacFilterCfg endpoint and examine router logs for signs of anomalous process crashes or unexpected reboots.

Compensating Controls: Restrict access to the router administrative interface to trusted internal IP addresses only, and implement a Web Application Firewall or similar filtering mechanism to sanitize inputs sent to the device configuration endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the remote exploitability and the existence of a public proof-of-concept, this vulnerability poses a significant risk to affected Tenda AC23 units. Administrators should prioritize isolating affected devices from the internet until a firmware update is applied to remediate the underlying memory corruption issue.