A critical buffer overflow vulnerability in Tenda AC10 v3 routers allows unauthenticated remote attackers to achieve full system compromise or permanent denial of service.

The flaw is a buffer overflow occurring within the /cgi-bin/UploadCfg endpoint, which fails to properly validate input data. This allows an unauthenticated, network-adjacent or remote attacker to bypass security controls and execute arbitrary code or render the device permanently unusable.

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Given the CVSS score of 9.8, the potential for unauthorized remote code execution means an attacker could gain full control over the router, facilitating lateral movement into internal segments or intercepting sensitive traffic. This could lead to significant data breaches, sustained service outages, and compromised operational integrity.

Immediate Action: Restrict access to the router management interface from untrusted networks and check the official Tenda support portal for firmware updates that address this vulnerability.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /cgi-bin/UploadCfg URI, which may indicate attempted exploitation.

Compensating Controls: Implement access control lists (ACLs) on the WAN interface to block external access to administrative endpoints and utilize a firewall to drop suspicious traffic patterns targeting the router management interface.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted at github.com/snyi001/Tenda-AC10-v3.

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate action is required to secure affected Tenda AC10 v3 devices. Administrators should ensure that management interfaces are not exposed to the public internet and prioritize applying vendor-supplied firmware patches as soon as they become available to prevent potential system compromise.