The vulnerability is a stack-based buffer overflow triggered by manipulating the firewallEn argument in the SetFirewallCfg interface of the HTTP daemon. This flaw allows an attacker to overwrite return addresses or other control data on the stack, potentially causing arbitrary code execution. The impact is that a remote actor can compromise the device, gaining full control over the firmware. The weakness is identified as CWE-119 and CWE-121, indicating improper bounds checking on user input.

Tenda AC19 routers running firmware version 16.03.10.07. The affected component is the httpd Web Management Service; any devices with this firmware are vulnerable.

The CVSS score is 10, reflecting high severity. The EPSS score is reported as <1%, suggesting a low probability of exploitation in the wild, but the risk remains because the exploit exists publicly and can be delivered remotely. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and stack corruption raise a significant threat for any deployment of the affected firmware.