The vulnerability is a stack-based buffer overflow (CWE‑121) triggered by manipulating the fmgpon_loid or fmgpon_loid_password argument on the /boaform/formgponConf endpoint. It also involves improper handling of input buffers (CWE‑119). The flaw allows an attacker to overwrite return addresses on the stack, which can lead to arbitrary code execution on the device. As remote exploitation is possible, the impact includes full compromise of the device’s confidentiality, integrity, and availability.

The flaw affects Tenda HG9 routers running firmware version 300001138, and the impact likely extends to earlier firmware versions that contain the same vulnerable component, though this is an inference. The product is commonly deployed in residential and small office environments.

The CVSS score of 8.7 indicates a high severity vulnerability. However, the EPSS score is less than 1%, implying a low likelihood of exploitation at the current time, and the vulnerability has not yet been listed in the CISA KEV catalog. The likely attack vector is remote, as the /boaform/formgponConf endpoint is exposed over HTTP/HTTPS. Publicly available exploit code reduces the barrier to exploitation for attackers willing to target vulnerable devices.