A critical stack-based buffer overflow vulnerability in Tenda i22 firmware allows remote, authenticated attackers to achieve arbitrary code execution.

The vulnerability exists in the formWeixinAuthInfoGet function within the /goform/wxportalauth endpoint. An attacker with low-level privileges can trigger a memory corruption by supplying an oversized string to the type parameter, which is passed to a vulnerable strcat operation without length validation.

Successful exploitation of this vulnerability permits remote code execution, which could lead to full device compromise and unauthorized access to the network segment where the device is deployed. Given the CVSS score of 8.8, this flaw represents a high risk to operational integrity and data security, particularly because the device serves as a gateway to broader infrastructure.

Immediate Action: Contact the vendor or consult the Tenda support portal to determine if a firmware update is available to address this specific stack-based buffer overflow. If no patch is available, restrict access to the web management interface to trusted administrative subnets only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/wxportalauth endpoint, specifically looking for abnormally long payloads in the type parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block requests to the vulnerable endpoint containing excessive data lengths in the type argument.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the research write-up by davybat on GitHub.

The presence of a public proof-of-concept combined with the potential for remote code execution makes this a high-priority item for remediation. Administrators should immediately isolate affected Tenda i22 devices from public-facing networks and apply vendor-supplied firmware updates as soon as they are made available to mitigate the risk of exploitation.