A critical stack-based buffer overflow vulnerability in Tenda i3 firmware version 1.0.0.6(2204) permits remote code execution, posing a significant threat to device integrity and network security.

The vulnerability resides in the formWifiMacFilterGet function within the /goform/WifiMacFilterGet endpoint. By sending a crafted POST request with an excessively long value in the index parameter, an authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution.

This vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for total system compromise. Successful exploitation allows an attacker to gain control over the affected network device, which may lead to unauthorized access to internal network traffic, credential theft, or the use of the device as a pivot point for further lateral movement within the corporate environment.

Immediate Action: Users should immediately update the Tenda i3 firmware to the latest available version provided by the manufacturer. If a patch is not yet available for your specific deployment, restrict management access to the device to trusted, isolated networks only.

Proactive Monitoring: Security teams should monitor system logs for suspicious POST requests directed at the /goform/WifiMacFilterGet endpoint. Sudden device reboots or unusual traffic patterns originating from the router should also be investigated as potential indicators of exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) configured to inspect and block excessively long payloads in POST request parameters, specifically targeting the index field.

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the research write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the high CVSS severity, organizations utilizing Tenda i3 devices must prioritize patching this vulnerability immediately. If immediate updates are not feasible, strict network segmentation and the implementation of robust traffic filtering are essential to mitigate the risk of remote exploitation.