A critical stack-based buffer overflow vulnerability in Tenda AC21 and AC23 routers exposes devices to remote denial of service attacks by unauthenticated attackers.

This is a stack-based buffer overflow (CWE-121) occurring within the GetParentControlInfo function of the /goform/GetParentControlInfo endpoint. The application fails to perform adequate boundary checks on the mac parameter, allowing an unauthenticated remote attacker to overflow the buffer and crash the service.

Successful exploitation of this vulnerability results in a denial of service, effectively taking the router offline and disrupting network connectivity for all dependent users and systems. Given the critical CVSS score of 9.8, the ability for an unauthenticated attacker to remotely crash networking infrastructure presents a significant risk to business continuity and operational availability.

Immediate Action: Currently, there is no official patch available; users should restrict access to the router management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests directed at the /goform/GetParentControlInfo endpoint, particularly those containing excessively long strings in the mac parameter.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion prevention system with custom rules to drop requests containing abnormally large payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher write-up linked in the CVE references.

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate defensive action. Organizations utilizing Tenda AC21 or AC23 routers must treat this as a high-priority risk and implement network-level access controls to isolate the management interface while awaiting vendor-supplied firmware updates.