A critical stack-based buffer overflow in Tenda HG9 routers allows authenticated remote attackers to achieve arbitrary code execution with root privileges.

The vulnerability exists within the formSamba function of the /boaform/formSamba endpoint, where the application uses the unsafe sprintf function to process user-supplied input. An authenticated attacker can provide an oversized string to the sambaCap parameter to overwrite the stack memory, potentially leading to remote code execution.

The exploitation of this vulnerability poses a severe risk to network security, as it allows attackers to gain full control over the router with root privileges. This could lead to unauthorized access to internal network traffic, data exfiltration, or the establishment of a persistent foothold within the environment. Given the high CVSS score of 8.8, immediate remediation is required to prevent compromise of critical infrastructure.

Immediate Action: Contact Tenda support or check the official Tenda website for firmware updates addressing this buffer overflow and apply them immediately.

Proactive Monitoring: Monitor device logs for anomalous requests directed at the /boaform/formSamba endpoint and investigate any unexpected system reboots or crashes of the router web interface.

Compensating Controls: Implement strict access control lists on the management interface to ensure only authorized administrative IP addresses can communicate with the router, effectively reducing the attack surface.

Public Exploit Available: Yes, a proof-of-concept exploit script is publicly available via the researcher's GitHub repository.

The presence of a public proof-of-concept exploit significantly increases the risk of this vulnerability being weaponized by malicious actors. Administrators must prioritize updating the firmware to a version that replaces unsafe functions like sprintf with secure alternatives such as snprintf. If a patch is currently unavailable, isolate the management interface from the network to prevent unauthorized access until a fix is applied.