A stack-based buffer overflow occurs in the formGetRebootTimer function when attackers manipulate the sys.schedulereboot.start_time and sys.schedulereboot.end_time parameters. This flaw allows an attacker to corrupt the stack on the device and execute arbitrary code, potentially compromising the firmware and all data processed by the router. The escalation can result in loss of confidentiality, integrity, and availability, and is classified as CWE-119 (Buffer Overflow) and CWE-121 (Stack Smashing).

The vulnerability affects Tenda AC9 routers with firmware version 15.03.06.42_multi (also listed as 5.03.06.42_multi). These appliances provide wireless and wired networking functions for small to medium sized environments.

The CVSS score of 8.6 indicates high severity, while the EPSS probability of less than 1 percent suggests low exploitation frequency at present. It is not included in CISA’s KEV catalog. Because the attack can be launched remotely through the router’s web interface, any network connected to the router is a potential attack surface. An attacker who succeeds can gain control of the device or perform a denial‑of‑service by exhausting stack space. No user intervention is required beyond remote access to the device’s configuration interface.