A critical stack-based buffer overflow in Tenda AC1206 allows authenticated remote attackers to gain full system control via the device naming function.

This vulnerability occurs in the /goform/SetOnlineDevName file, specifically within the set_device_name function. An authenticated attacker can trigger a stack-based buffer overflow by providing a malicious devName argument, which is processed without sufficient length validation.

The CVSS score of 8.8 reflects the high risk of this vulnerability. Successful exploitation grants an attacker the ability to execute code with system-level privileges, resulting in potential device compromise, network traffic manipulation, and the loss of confidentiality and integrity for all connected systems.

Immediate Action: Verify if a firmware update is available from Tenda and apply it immediately. If no update is available, disable the web management interface if possible, or restrict access to trusted internal IP addresses only.

Proactive Monitoring: Inspect network logs for unusual traffic patterns directed at the /goform/SetOnlineDevName endpoint, particularly requests containing large or unexpected characters in the devName parameter.

Compensating Controls: Implement WAF rules to validate input length for all requests targeting the device management interface, effectively blocking potential overflow attempts.

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Given the severity of this remote code execution vulnerability and the availability of public exploit code, swift action is required. Organizations must treat this as a high-priority item, implementing network-level access controls to protect the management interface until a vendor-validated firmware update is applied.