The firmware of certain Tenda RX3 routers contains a flaw in the fromSetIpMacBind function, which processes inputs sent to the /goform/SetIpMacBind endpoint. The user-controlled argument list can overflow a local stack buffer, a classic stack-based buffer overflow (CWE‑119) that may corrupt adjacent data including return addresses (CWE‑121). If successfully exploited, an attacker could inject and execute arbitrary code on the device, giving full control of the router.

The vulnerability affects the Tenda RX3 model running firmware version 16.03.13.11. Users of this particular build should check the firmware version on their device and verify whether the router’s SetIpMacBind interface is exposed.

The flaw carries a CVSS score of 8.7, indicating high severity, but its EPSS score is below 1 %, meaning it is not yet widely observed in the wild. The attack can be launched from any remote location that can reach the router’s web interface, and the exploit has already been publicly disclosed. Although the vulnerability is not yet listed in the CISA KEV catalog, the combination of remote accessibility and the potential for remote code execution warrants serious consideration.