A critical buffer overflow vulnerability in Tenda TX9 routers, identified in firmware version 22.03.02.10_multi, poses a significant risk of remote code execution.

The vulnerability exists within the function sub_432580 of the /goform/fast_setting_wifi_set endpoint. An attacker with low privileges can supply an overly long ssid parameter, which lacks sufficient length validation, resulting in a stack-based buffer overflow that facilitates remote code execution or denial of service.

Successful exploitation of this flaw allows an unauthenticated or low-privileged remote attacker to gain control over the affected network device. This could lead to full compromise of the router, interception of internal network traffic, or use of the device as a pivot point for further attacks on the internal infrastructure, warranting a high-severity rating given its CVSS score of 8.8.

Immediate Action: Contact Tenda support or check the official Tenda support portal to identify and apply the latest firmware update that addresses this buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/fast_setting_wifi_set endpoint and review router logs for signs of unexpected system reboots or crashes.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and employ a network firewall to block unauthorized external access to the device management ports.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the MRAdera research write-up.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat to internal network security. Administrators must prioritize updating the firmware on all affected Tenda TX9 units to the version recommended by the vendor to eliminate this risk immediately.