A critical stack-based buffer overflow vulnerability in Tenda AC9 routers allows remote attackers to compromise device stability or execute arbitrary code.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered by the improper handling of the security.ddos.map argument within the formGetDdosDefenceList and formGetFirewallCfg functions. An attacker with administrative access can upload a specially crafted configuration file to trigger memory corruption, potentially leading to remote code execution.

Successful exploitation of this vulnerability results in a complete denial of service for the router web interface, which is difficult to recover from even after a reboot. Because the flaw allows for potential remote code execution, an attacker could gain full control over the networking equipment, leading to unauthorized access to internal network traffic, data interception, and lateral movement within the environment. The CVSS score of 7.2 reflects the high risk posed by remote exploitability and the potential for total loss of system integrity.

Immediate Action: There is no official patch currently available; users should restrict administrative access to the router web interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for frequent, unexpected web service restarts or unauthorized configuration change attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network filtering to inspect incoming traffic for malformed configuration payloads, and disable remote management features on the device.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up referenced by the CVE record.

Given the availability of public proof-of-concept code and the high potential for system compromise, administrators must prioritize the security of their Tenda AC9 devices. Since a vendor patch is currently unknown, immediate risk reduction through network segmentation and the strict limitation of administrative access is mandatory to prevent unauthorized exploitation.