A critical buffer overflow vulnerability in Tenda AC7 and AC18 routers may allow a remote, authenticated attacker to achieve code execution or system instability.

The vulnerability exists in the formSetSchedLed function within the /goform/SetLEDCfg endpoint. An authenticated attacker can trigger a buffer overflow by supplying an overly long Time parameter in a POST request, leading to potential memory corruption or remote code execution.

Successful exploitation of this flaw allows an attacker to execute arbitrary code with elevated privileges on the affected networking hardware. This compromise can lead to complete loss of confidentiality and integrity for traffic passing through the device, as well as significant operational disruption. Given the CVSS score of 8.8, this represents a high-severity threat to network infrastructure.

Immediate Action: Administrators should verify if their Tenda AC7 or AC18 units are running the affected firmware versions and apply the latest security patches provided by the vendor immediately.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/SetLEDCfg endpoint and review device logs for signs of unexpected reboots or crashes.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and employ a Web Application Firewall or network-level inspection to filter malformed POST payloads.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher and referenced in the CVE record.

The presence of a functional proof-of-concept code necessitates immediate action to secure these devices. Affected organizations must prioritize firmware updates to close this security gap, as the potential for remote code execution on edge networking equipment poses a severe risk to the entire internal network environment.