A stack-based buffer overflow exists in the set_device_name operation of the MAC Filtering Configuration Endpoint on certain Tenda RX3 routers. The flaw allows an attacker to supply an overly long devName parameter, causing an uncontrolled write on the stack. The vulnerability is characterized as a classic out‑of‑bounds write (CWE‑119) and a stack corruption (CWE‑121), potentially enabling arbitrary code execution or system compromise from a remote source.

The impact is limited to Tenda RX3 devices running firmware version 16.03.13.11. No other Tenda products or firmware versions were explicitly listed as affected.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is below 1 percent, indicating a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP request to the /goform/setBlackRule endpoint. Based on the description, it is inferred that the attack can be carried out over the network without local presence. The combination of high impact and low exploitation probability places the risk in a cautionary zone, but the potential for remote code execution warrants swift action.