A critical stack-based buffer overflow vulnerability in Tenda i3 firmware exposes affected devices to remote code execution risks.

The device is vulnerable to a stack-based buffer overflow within the formSetCfm function, specifically triggered through the funcpara1 parameter on the /goform/setcfm endpoint. The vulnerability can be exploited by an authenticated attacker to achieve remote code execution.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target device, potentially leading to full system compromise. Given the CVSS score of 8.8, this represents a high-severity risk that could result in unauthorized network access, data exfiltration, or the use of the device as a pivot point for further attacks within the internal network.

Immediate Action: Check the Tenda support website for firmware updates; if no update is available for version 1.0.0.6(2204), restrict access to the management interface.

Proactive Monitoring: Review web server logs for irregular POST requests directed at /goform/setcfm, particularly those containing unusually long string values in the funcpara1 parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block unauthorized access to the administration interface of the affected device.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's GitHub repository.

Due to the severity of the buffer overflow and the availability of public technical details, administrators should prioritize securing the management interface of all Tenda i3 devices. Until a vendor-supplied patch is identified and applied, isolating these devices from external or untrusted network segments is the most effective method to mitigate the risk of remote code execution.