Tenda i3 WifiMacFilterSet formWifiMacFilterSet 堆栈缓冲区溢出

The vulnerability allows a remote attacker to trigger a stack-based buffer overflow by manipulating the 'index' argument within the /goform/WifiMacFilterSet function. Successful exploitation can lead to arbitrary code execution on the affected Tenda i3 device. This grants the attacker complete control over the router, including the ability to modify configurations, intercept network traffic, and potentially pivot to other devices on the network. Given the public availability of a proof-of-concept, the risk of exploitation is high, and the potential impact is severe, mirroring the consequences of other router-based remote code execution vulnerabilities.

Small and medium-sized businesses (SMBs) and home users relying on Tenda i3 routers are at significant risk. Shared hosting environments utilizing these routers for network management are particularly vulnerable, as a compromise of one router could potentially impact multiple users. Legacy configurations with default passwords and outdated firmware exacerbate the risk.

• tenda: Monitor router logs for unusual activity related to /goform/WifiMacFilterSet. • tenda: Use network monitoring tools to detect connections to the router's management interface from unexpected sources. • generic web: Use curl/wget to test the /goform/WifiMacFilterSet endpoint with oversized or malformed input and observe error responses. • generic web: Monitor access logs for requests containing suspicious parameters in the /goform/WifiMacFilterSet URL.

1. 2026-03-09Disclosure

   disclosure

1. 已保留2026-03-08
2. 发布日期2026-03-09
3. 修改日期2026-03-10
4. EPSS 更新日期2026-03-23

While a patch is pending, several mitigation steps can reduce the risk. First, implement strict firewall rules to limit external access to the /goform/WifiMacFilterSet endpoint. Input validation should be implemented to sanitize the 'index' argument, preventing oversized or malicious values. Consider temporarily disabling the MAC filter functionality if it's not essential. Monitor network traffic for unusual activity and suspicious connections. After implementing these mitigations, verify their effectiveness by attempting to access the vulnerable endpoint with a controlled, benign payload to ensure it is properly filtered.