The affected function sub_4223E0 in Tenda TX9's firmware handles a device list used to configure MAC filtering. An attacker can supply a crafted deviceList payload that exceeds the internal buffer, causing a stack‑based buffer overflow. This overflow could potentially allow remote code execution when the firmware processes the input, and the attack can be carried out remotely through the web management interface. The vulnerability is classified as CWE-119 and CWE-120.

Devices manufactured by Tenda using the TX9 product line and running firmware versions up to 22.03.02.10_multi are vulnerable. The issue was reported for all builds of the TX9 firmware to that release, and no fixes have yet been released publicly; users should verify their firmware revision.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, and the public exploit exists on GitHub. Based on the description, it is inferred that attackers can reach the vulnerable endpoint over the network without authentication, making the attack vector remote. Because the flaw occurs in buffer handling, successful exploitation would depend on reaching the firmware's management interface and sending a malformed payload. Overall, the risk is high severity with low to medium likelihood of exploitation at present.