A stack‑based buffer overflow exists in the webCgiGetUploadFile function of the /cgi-bin/UploadCfg endpoint of the Tenda A18 Httpd Service. By manipulating the boundary of an argument, an attacker can overflow a stack buffer, which can lead to arbitrary code execution. The vulnerability is classified as a buffer overflow (CWE‑119) and a stack overflow (CWE‑121). The public exploit indicates that an attacker can trigger this flaw remotely and execute code with the privileges of the web server process, thereby compromising confidentiality, integrity, and availability of the device.

The affected product is the Tenda A18 router, firmware version 15.13.07.13. No other models or firmware revisions are listed as impacted.

The CVSS score of 5.3 suggests moderate severity. The EPSS score of less than 1 % indicates a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The flaw can be exploited remotely via the HTTP service without authentication, so the attack vector is inferred to be the network layer, targeting the router’s upload configuration interface. Because the exploit is publicly available, it may be used in the wild, especially against devices with default or weak credentials.