A critical stack-based buffer overflow vulnerability in Tenda A18 Pro firmware version V02.03.02.28 poses a significant risk of remote code execution or system compromise.

The vulnerability exists in the sub_423B50 function within the /goform/setMacFilterCfg endpoint, where insufficient bounds checking on the deviceList parameter leads to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements, the flaw allows remote manipulation of memory, which can be leveraged to overwrite the return address.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the web server or cause a complete denial of service of the networking device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized network access, interception of traffic, or complete takeover of the affected router, resulting in significant operational downtime or data breach.

Immediate Action: As no official patch is currently available, immediately restrict access to the web management interface of the Tenda A18 Pro to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repetitive or malformed POST requests to the /goform/setMacFilterCfg endpoint, which may indicate attempts to trigger the buffer overflow.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) rule to block or sanitize input to the /goform/setMacFilterCfg endpoint, specifically filtering for excessively long strings in the deviceList parameter.

Public Exploit Available: Yes — a public proof-of-concept Python script is available via the researcher's GitHub repository.

The severity of this flaw necessitates immediate attention. Organizations utilizing Tenda A18 Pro routers should isolate these devices from the public internet immediately and monitor for anomalous traffic patterns until the vendor provides a firmware update. Failure to mitigate this risk leaves the infrastructure vulnerable to remote exploitation.