A critical buffer overflow vulnerability in Tenda TX9 Pro firmware allows remote code execution through improper input validation.

This vulnerability is a stack-based buffer overflow occurring in the sub_4223E0 function, triggered by sending a specially crafted deviceList parameter to the /goform/setMacFilterCfg endpoint. While the CVSS vector indicates a requirement for low-level privileges, the flaw allows an authenticated attacker to achieve remote code execution or cause a denial of service.

The ability for an attacker to achieve remote code execution on network infrastructure poses a severe threat to internal network integrity and data privacy. Successful exploitation could allow unauthorized actors to pivot into the local network, intercept traffic, or completely disable critical routing services. With a CVSS score of 8.8, this vulnerability is considered High severity and demands immediate attention to prevent full system compromise.

Immediate Action: Since a vendor-provided patch is currently unknown, users should immediately restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP POST requests directed toward the /goform/setMacFilterCfg endpoint, particularly those containing unusually large payloads in the deviceList field.

Compensating Controls: Deploy a Web Application Firewall or similar inspection tool to filter and drop requests to the vulnerable endpoint that exceed expected length constraints for the deviceList parameter.

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the research write-up).

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability represents a significant risk to affected Tenda TX9 Pro deployments. Organizations must prioritize segmenting these devices from external-facing networks and monitor for potential exploitation attempts while awaiting a formal vendor firmware update.