A critical stack-based buffer overflow in Tenda HG9 routers poses a severe risk of remote code execution and system instability.

This vulnerability is a stack-based buffer overflow occurring within the /boaform/formLoopBack endpoint. By providing an overly long string to the Ethtype parameter, an attacker can trigger a memory corruption event, which may lead to service crashes or arbitrary code execution with root privileges.

The potential for remote code execution on network infrastructure devices creates a significant security risk, as compromised routers can serve as beachheads for lateral movement within a private network. Successful exploitation could result in full system compromise, loss of confidentiality for intercepted traffic, and prolonged service outages. Given the CVSS score of 8.8, this vulnerability is considered high severity and requires immediate attention to prevent unauthorized access.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests directed at the /boaform/formLoopBack endpoint and review system logs for recurring crashes of the httpd service.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to inspect and block HTTP requests containing unexpectedly long values in the Ethtype parameter.

Public Exploit Available: Yes — a functional proof-of-concept script is available via the referenced GitHub security research write-up.

Given the availability of a functional proof-of-concept and the critical nature of a stack-based buffer overflow on edge networking equipment, organizations must prioritize the isolation of affected Tenda HG9 devices. Administrators should ensure that management interfaces are strictly firewalled from untrusted networks until a vendor-supplied firmware update is released and applied.