A critical stack-based buffer overflow vulnerability in Tenda HG9 firmware allows authenticated remote attackers to trigger a system crash or execute arbitrary code.

The vulnerability exists in the /boaform/formPing6 endpoint, where the application uses an unbounded sprintf function to format user-supplied input into a fixed-size 512-byte stack buffer. An authenticated attacker can provide an excessively long string to the pingAddr parameter, triggering a buffer overflow that overwrites the stack return address.

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. By achieving remote code execution, an attacker could gain full control over the affected router, facilitating lateral movement within the network, interception of traffic, or permanent denial of service. The CVSS score of 8.8 reflects the high potential for total system compromise, necessitating immediate attention.

Immediate Action: Contact Tenda support or check the official Tenda website for firmware updates addressing this buffer overflow and apply the patch as soon as it becomes available.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /boaform/formPing6 endpoint, particularly those containing unusually long strings in the pingAddr parameter.

Compensating Controls: If a patch is unavailable, restrict administrative access to the router management interface to trusted IP addresses only and disable remote management features where possible to reduce the attack surface.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up referenced in the CVE record.

This vulnerability represents a significant security risk to Tenda HG9 devices due to the potential for remote code execution. Administrators should treat this as a high-priority item and ensure that any available firmware updates are applied immediately to mitigate the risk of unauthorized access or device compromise.