A critical stack-based buffer overflow vulnerability in Tenda AC7 routers allows for remote code execution via a manipulated system time configuration request.

This vulnerability exists in the fromSetSysTime function within the /goform/SetSysTimeCfg component. An authenticated user can trigger a stack-based buffer overflow by sending a crafted Time argument via a POST request.

The ability to trigger a stack-based buffer overflow remotely poses a severe threat to network integrity. If exploited, this flaw could allow an attacker to execute arbitrary code with system-level privileges, leading to a complete compromise of the router, unauthorized access to network traffic, or the potential for lateral movement within the environment. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent device takeover.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the web management interface to trusted internal IP addresses only. Disable remote management features if they are not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /goform/SetSysTimeCfg endpoint. Review system logs for signs of process crashes or unexpected service restarts on the device.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and block malformed payloads sent to the SetSysTimeCfg function.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher write-up linked in the references.

This vulnerability represents a significant security risk to Tenda AC7 devices. Because a public proof-of-concept is available, the barrier to entry for potential attackers is low. Organizations should prioritize isolating affected devices from public-facing networks and monitor for vendor-provided firmware updates. Apply all available security patches immediately upon their release by the manufacturer.