A flaw in the formGetDdosDefenceList function of Tenda AC9 firmware 15.03.06.42_multi allows an attacker to manipulate the security.ddos.map argument so that the target device’s stack buffer overflows. The vulnerability is a classic stack-based overflow identified by CWE-119 and CWE-121 and could corrupt control flow on the router. It can thus compromise router integrity, allow remote code execution, or crash the device, resulting in loss of availability for all local network traffic.

Tenda manufactures the AC9 consumer router, and the specific firmware revision 15.03.06.42_multi is affected. Devices operating this firmware are susceptible to the overflow; no other Tenda models or firmware versions were listed as vulnerable in the available data.

The CVSS score of 8.6 indicates a high severity. Although the EPSS score is below 1%, the vulnerability is already in the public domain and documented exploits exist, so the likelihood of real-world use is non‑negligible. The remote attack vector implies that an external actor can send crafted traffic to the router to trigger the overflow, which could result in remote code execution or a denial‑of‑service if exploited.