A stack-based buffer overflow is triggered when an attacker supplies a crafted Ethtype argument to the /boaform/formLoopBack endpoint on Tenda HG9 routers running firmware 300001138. This overflow occurs in the loopback detection configuration component and may overwrite the stack. Based on the description, it is inferred that the attacker could gain arbitrary code execution, potentially taking full control of the device. The flaw represents a classic stack corruption weakness described by CWE-119 and CWE-121.

The affected product is the Tenda HG9 router model HG9, firmware version 300001138. No other models or firmware revisions are explicitly listed as vulnerable in the CNA data.

The CVSS base score of 8.7 classifies this vulnerability as high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is remote: an adversary can send a malicious Ethtype value to the formLoopBack endpoint over the network. Once triggered, the stack corruption can lead to arbitrary code execution, giving the attacker full device compromise. This danger is inferred from the stack-based nature of the overflow.