A critical stack-based buffer overflow in Tenda HG9 routers allows authenticated attackers to compromise device stability or achieve remote code execution.

The vulnerability exists in the /boaform/formgponConf endpoint, where the sprintf function copies user-supplied fmgpon_loid and fmgpon_loid_password parameters into a fixed-size 128-byte stack buffer without boundary checks. This flaw requires the attacker to have low-level privileges to interact with the configuration endpoint.

Successful exploitation of this vulnerability allows an attacker to crash the device web interface, resulting in a denial of service, or to hijack the device by overwriting the return address on the stack. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full administrative compromise of the networking hardware, potentially allowing attackers to intercept traffic or gain persistent access to the local network.

Immediate Action: Contact Tenda support or check the official Tenda website for firmware updates addressing this buffer overflow, as no official patch version is currently identified.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boaform/formgponConf endpoint and review system logs for recurring service crashes or unexpected reboots.

Compensating Controls: Restrict access to the router management interface to trusted administrative IP addresses only, and employ a network firewall to block unauthorized access to the web administration port.

Public Exploit Available: Yes, a functional proof-of-concept script has been published in the technical write-up referenced by the CVE record.

Due to the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat to network integrity. Administrators should immediately restrict administrative access to the affected devices and prioritize the deployment of vendor-supplied firmware updates as soon as they become available to eliminate the underlying memory corruption flaw.