The vulnerability is a classic stack overflow located in the SetStaticRouteCfg function of the Tenda TX9 firmware. A specially crafted request to /goform/SetStaticRouteCfg can overflow a stack buffer and overwrite adjacent memory, potentially allowing an attacker to execute arbitrary code with the privileges of the firmware process. The weakness is categorized as CWE-121.

The flaw affects Tenda TX9 devices running firmware version V22.03.02.20. No other firmware releases are cited in the advisory.

The CVSS score of 9.8 indicates a severe risk, and the EPSS score of less than 1% suggests a low probability of exploitation at the moment. The device is not listed in CISA KEV. Exploitation would likely be performed remotely through the web‑based management interface, as the vulnerable endpoint is accessible over HTTP. The attack would require sending a malicious payload that triggers the stack overflow. The description indicates that a specially crafted HTTP request to /goform/SetStaticRouteCfg triggers the overflow, so the attack vector is inferred to be remote web exploitation.