A critical buffer overflow vulnerability in Tenda AC20 routers allows remote attackers to compromise device integrity, with publicly available proof-of-concept exploit code currently circulating.

The vulnerability originates from a lack of boundary checking in the strcpy function within the /goform/saveParentControlInfo file, specifically when processing the time argument. While the CVSS vector indicates low privileges are required, the flaw allows an authenticated attacker to trigger a buffer overflow, leading to potential denial of service or remote code execution.

Successful exploitation of this vulnerability can lead to a complete loss of confidentiality, integrity, and availability for the affected networking hardware. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized network access, internal traffic interception, or the permanent bricking of edge routing devices.

Immediate Action: As no patch is currently identified, administrators should restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Review web access logs for anomalous POST requests directed at the /goform/saveParentControlInfo endpoint, particularly those containing unusually long string values in the time parameter.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to inspect and block malformed HTTP requests targeting the vulnerable management forms.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced in the CVE record.

The presence of a functional proof-of-concept significantly increases the risk of exploitation. Organizations utilizing Tenda AC20 devices must prioritize isolating the management interface from untrusted networks immediately. Monitor vendor support channels closely for firmware updates and apply them as soon as they become available to remediate the underlying memory corruption flaw.