A stack based buffer overflow vulnerability in Tenda i3 firmware version 1.0.0.6(2204) allows authenticated attackers to achieve remote code execution, posing a significant risk to network integrity.

The vulnerability exists within the formWifiMacFilterSet function located at the /goform/WifiMacFilterSet endpoint. By providing an excessively long string to the index argument, an authenticated attacker can trigger a stack based buffer overflow, leading to memory corruption and potential remote code execution.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code with elevated privileges on the affected networking device. This could lead to full device compromise, enabling the attacker to intercept network traffic, modify configuration settings, or pivot into the internal network, resulting in severe data loss and unauthorized access. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security.

Immediate Action: There is currently no official patch available from the vendor. Administrators should restrict access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor system logs for repeated crash events or unusual POST requests directed at the /goform/WifiMacFilterSet endpoint, which may indicate attempted exploitation.

Compensating Controls: Implement strict network segmentation and utilize a firewall to block unauthorized access to the web management interface of the Tenda i3 device.

Public Exploit Available: Yes, a proof of concept is available via the researcher's GitHub repository.

Given the availability of a public proof of concept and the potential for remote code execution, this vulnerability poses a severe threat to affected Tenda i3 devices. Organizations should prioritize isolating these devices from external networks and restrict management access. Users should monitor the official Tenda support website for firmware updates and apply them as soon as they become available.