The Tenda RX3 firmware 16.03.13.11 contains a notorious stack-based buffer overflow in the set_qosMib_list function, which is invoked through the web form /goform/formSetQosBand. By submitting a crafted argument list, an attacker can overflow the function’s stack buffer, resulting in an arbitrary code execution capability. The vulnerability is classified as a buffer overflow (CWE-119) combined with a stack-based buffer overrun (CWE-121). No user interaction is required other than sending a malicious request to the device’s management interface, and an exploit has already appeared in the public domain.

Tenda RX3 wireless routers running firmware 16.03.13.11 are affected. The vendor, Tenda, lists the product under the RX3 model, and the specific firmware version is identifiable in the CPE data as 16.03.13.11.

The CVSS score of 8.7 places this flaw in the high severity range, and the EPSS scoring indicates that exploitation probability is currently below 1%, though nonzero. Because the flaw is reachable remotely via the device’s web interface, and a public exploit exists, the risk of compromise is tangible for any mathematically unprotected environments. The vulnerability is not present in CISA’s KEV catalogue, but that does not diminish the need for mitigation. The likely attack path is a remote attacker sending a specially crafted HTTP request to the /goform/formSetQosBand endpoint, which triggers a stack overflow and consequently arbitrary code execution.