A critical stack-based buffer overflow vulnerability in the Tenda A18 Pro router could allow a remote authenticated attacker to execute arbitrary code or crash the device.

The vulnerability exists in the set_qosMib_list function within the /goform/formSetQosBand endpoint, where unsanitized user input is copied into a fixed-size stack buffer using the unsafe strcpy function. Exploitation requires the attacker to have low-level authenticated access to the management interface.

Successful exploitation of this vulnerability could grant an attacker full control over the affected router, facilitating unauthorized access to internal network traffic or the ability to pivot into the local network. Given the CVSS score of 8.8, this poses a significant risk to data confidentiality and network integrity, potentially leading to total system compromise and operational downtime.

Immediate Action: Update the Tenda A18 Pro firmware to the latest available version provided by the manufacturer that addresses this buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetQosBand endpoint and audit router access logs for suspicious administrative activity.

Compensating Controls: Restrict access to the router management interface to trusted IP addresses only and disable remote management features if they are not strictly required for business operations.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's GitHub repository.

This vulnerability represents a high-severity risk to network infrastructure. Administrators must prioritize updating the firmware on all affected Tenda A18 Pro devices immediately. If an update is not currently feasible, isolate the management interface from untrusted networks to prevent exploitation by unauthorized actors.