A critical stack-based buffer overflow vulnerability in Tenda i12 routers enables remote code execution, posing a significant risk to network integrity.

This vulnerability is a stack-based buffer overflow (CWE-121) caused by insecure use of the vos_strcpy function within the /goform/exeCommand file. The flaw allows an authenticated remote attacker to corrupt memory by manipulating the cmdinput argument.

The exploitation of this vulnerability can lead to full system compromise, as the buffer overflow permits arbitrary code execution on the affected hardware. Given the high CVSS score of 8.8, this flaw represents a major security risk that could facilitate unauthorized access to internal network traffic, data interception, or the use of the device as a pivot point for further attacks on the enterprise network.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management interface of the Tenda i12 device to trusted internal segments only.

Proactive Monitoring: Monitor device logs for unusual traffic directed at the /goform/exeCommand endpoint and look for unexpected crashes or service restarts that may indicate exploitation attempts.

Compensating Controls: Implement strict firewall rules to block external access to the device management interface and consider placing the device behind a robust VPN or internal-only segment to prevent remote exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the vulnerability report at https://github.com/Jimi-Lab/cve/issues/1.

Due to the availability of a public proof-of-concept and the high potential for remote code execution, this vulnerability poses an urgent threat to Tenda i12 deployments. Organizations must prioritize segmenting these devices from the public internet immediately and continue monitoring vendor communication channels for the release of an official firmware update to remediate this flaw.