A critical stack-based buffer overflow in Tenda A18 Pro firmware enables remote code execution, posing a severe risk to device integrity.

The vulnerability is a stack-based buffer overflow located in the fromSetIpMacBind function within the /goform/SetIpMacBind endpoint. By sending a maliciously crafted list parameter, an authenticated attacker can trigger an unsafe strcpy operation that overwrites the stack frame and allows for arbitrary code execution or a denial of service.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected router with root privileges. This grants the attacker full control over the network gateway, potentially leading to unauthorized data interception, internal network pivoting, or complete loss of service. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security.

Immediate Action: Users should immediately update the Tenda A18 Pro firmware to a version beyond V02.03.02.28 that addresses this buffer overflow. If no patch is available, restrict access to the web management interface to trusted administrative networks only.

Proactive Monitoring: Monitor device logs for unexpected crashes of the httpd process or recurrent timeouts when accessing the IP-MAC binding configuration page.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /goform/SetIpMacBind endpoint that contain excessively long strings in the list parameter.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue linked by the researcher.

This vulnerability presents a significant risk to the security of the Tenda A18 Pro router. Administrators must prioritize updating the firmware to the latest available version to remediate the buffer overflow. Given the availability of a public proof-of-concept, the likelihood of exploitation by threat actors is elevated, making timely patching or network-level isolation mandatory.