A critical stack-based buffer overflow in Tenda HG9 firmware allows remote, authenticated attackers to crash the device or execute arbitrary code.

The vulnerability exists in the /boaform/formPing diagnostic endpoint, where an unsafely used sprintf function fails to validate the length of the pingAddr parameter. An authenticated attacker can supply an overly long string to trigger a memory corruption, leading to a stack-based buffer overflow.

The exploitation of this vulnerability can lead to a complete denial of service of the router, potentially disrupting critical network connectivity for all downstream users. Furthermore, because the vulnerability allows for the overwriting of the return address, it presents a risk of arbitrary code execution, which could lead to full device compromise and unauthorized access to internal network traffic. The CVSS score of 8.8 reflects the high severity of this impact.

Immediate Action: As no official vendor patch is currently confirmed, users should restrict administrative access to the web interface to trusted management networks only. Disable the diagnostic ping feature if it is not required for daily operations.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual HTTP POST requests directed at the /boaform/formPing endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security policy to inspect and reject unusually long strings within the pingAddr parameter of HTTP requests.

Public Exploit Available: Yes, a proof-of-concept script exists in the public research write-up on GitHub.

Given the potential for remote code execution and the availability of a functional proof-of-concept, this vulnerability poses a significant risk to network integrity. Organizations utilizing the Tenda HG9 router should prioritize restricting management access and monitoring for suspicious traffic until an official firmware update is issued by Tenda.