A critical stack-based buffer overflow vulnerability in Tenda i3 devices enables remote attackers to execute arbitrary code or cause a system crash.

This vulnerability is a stack-based buffer overflow (CWE-121) located in the formSetAutoPing function within the /goform/setAutoPing endpoint. An attacker with low privileges can trigger this memory corruption by supplying excessively long strings to the ping1 or ping2 parameters.

The exploitation of this vulnerability poses a severe risk to network infrastructure. Because the flaw allows for memory corruption and potential remote code execution, an attacker could gain unauthorized control over the affected device, leading to full compromise of the router, interception of sensitive network traffic, or total loss of availability for connected services. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent device takeover.

Immediate Action: Administrators should verify if their Tenda i3 devices are running firmware version 1.0.0.6(2204) and apply any available security patches provided by Tenda immediately.

Proactive Monitoring: Security teams should monitor network access logs for suspicious POST requests directed at the /goform/setAutoPing endpoint, specifically looking for unusually long parameter values.

Compensating Controls: If a patch is unavailable, deploy a Web Application Firewall (WAF) or intrusion prevention system to filter and block malformed HTTP requests containing excessive data in the ping1 or ping2 fields.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up on GitHub.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents an urgent security risk. Organizations utilizing Tenda i3 hardware must prioritize firmware updates or implement robust network filtering to block access to the vulnerable endpoint until a permanent fix is applied.