The vulnerability is a stack-based buffer overflow located in the sub_42D03C routine of the /goform/SetStaticRouteCfg handler on Tenda TX9 routers. A crafted list of arguments sent to this function can overwrite adjacent memory, potentially allowing an attacker to inject or execute arbitrary code or crash the device. The flaw exists in firmware versions up to 22.03.02.10_multi and is exploitable remotely without authentication, with a publicly available proof‑of‑concept. The impact is consistent with a high‑severity remote code execution or denial of service if the overflow can be leveraged for malicious code injection.

Tenda TX9 routers running firmware versions up to 22.03.02.10_multi are affected. The CVE references a single vendor–product pair, Tenda TX9, and the corresponding CPE strings identify the hardware and firmware families.

The vulnerability scores a CVSS of 8.7, indicating a high severity, while the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely but not impossible. The flaw is not listed in the CISA KEV catalog, but the existence of a public exploit increases the risk of targeted attacks. Given that the attack vector is remote and requires only a crafted HTTP request, an attacker with internet reach to the device’s management interface could trigger the overflow. Without a patch or mitigation in place, the potential consequences include loss of device control or complete network disruption.