A critical stack-based buffer overflow vulnerability in Tenda A18 firmware allows remote attackers to trigger a system crash or execute arbitrary code.

The vulnerability is a stack-based buffer overflow (CWE-121) occurring in the set_repeat5 function of the httpd service. An authenticated attacker can provide an overly long string to the wpapsk_crypto5g parameter, which is copied into a fixed 16-byte stack buffer using the unsafe strcpy function, leading to memory corruption.

Successful exploitation of this vulnerability allows an attacker to gain control over the affected network device or cause a complete denial of service. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized network access, interception of traffic, or persistent compromise of the local infrastructure.

Immediate Action: Update the Tenda A18 device to the latest available firmware version provided by the manufacturer. If an update is not available, isolate the device from untrusted networks immediately.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /goform/WifiExtraSet endpoint. Monitor for unexpected device reboots or service outages that may indicate exploitation attempts.

Compensating Controls: Implement strict access control lists on the management interface to ensure only authorized administrative IP addresses can interact with the device. Utilize a network-based firewall or intrusion detection system to block malformed HTTP requests containing excessively long parameter strings.

Public Exploit Available: Yes, a proof-of-concept Python script is available via the researcher write-up on GitHub.

The severity of this vulnerability, combined with the availability of a functional proof-of-concept, necessitates immediate attention. Administrators must prioritize applying firmware patches or restricting access to the web management interface to prevent potential remote code execution and unauthorized device control.