A critical stack-based buffer overflow vulnerability in Tenda AC15 routers permits remote code execution, posing a severe risk to network integrity.

This is a stack-based buffer overflow (CWE-121) occurring in the /goform/TextEditingConversion file. An attacker with low-level privileges can trigger memory corruption by manipulating the wpapsk_crypto2_4g argument.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the target device. This can lead to a complete compromise of the router, enabling attackers to intercept network traffic, redirect users to malicious sites, or gain a foothold within the internal network. Given the CVSS score of 8.8, this flaw represents a high-severity risk to business continuity and data confidentiality.

Immediate Action: Contact the vendor for the latest firmware release, as no official patch is currently confirmed for all affected versions. If no update is available, restrict management access to the device to trusted internal segments only.

Proactive Monitoring: Review system logs for suspicious activity targeting the /goform/TextEditingConversion endpoint. Monitor for unexpected router reboots or anomalous traffic patterns originating from the device.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with signatures configured to detect and block malicious payloads directed at the vulnerable /goform/TextEditingConversion URL.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up at the provided Yuque reference.

Due to the availability of a public proof-of-concept and the high-severity nature of remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating affected Tenda AC15 devices from external exposure and monitor vendor channels for the release of a definitive firmware patch.