A critical buffer overflow vulnerability in the Tenda M3 Access Controller allows a remote, authenticated attacker to trigger a denial of service condition.

The vulnerability is a buffer overflow occurring in the setAdvPolicyData function when handling the rebootTime parameter. An authenticated attacker can supply a specially crafted string to the web interface to overwrite memory and crash the device service.

The exploitation of this vulnerability results in a denial of service, rendering the Tenda M3 Access Controller management interface unresponsive. Given the CVSS score of 8.8, this poses a high risk to operational continuity, as administrators may lose the ability to manage network policies or perform critical configuration tasks until the device is manually recovered.

Immediate Action: Users should contact Tenda support or monitor the official Tenda website for a firmware update that addresses the unsafe use of the strncpy function.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests directed at the /goform/setAdvPolicyData endpoint that contain unusually long strings in the rebootTime parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and restrict the length of input parameters submitted to the /goform/setAdvPolicyData interface to prevent malformed data from reaching the vulnerable function.

Public Exploit Available: Yes — a published proof-of-concept exists in the referenced GitHub security issue.

The severity of this vulnerability necessitates immediate attention to prevent potential service disruptions. Administrators are urged to restrict access to the management interface of affected Tenda M3 devices to trusted internal networks only and to apply the necessary firmware patches as soon as they are made available by the vendor.