The vulnerability resides in the fromGstDhcpSetSer function of the Tenda AC1206 firmware where multiple stack overflows can be triggered by supplying crafted username and password values. These overflows corrupt the stack and cause the device to crash, resulting in a denial of service. The flaw does not provide remote code execution or unauthorized access, but it disables the device’s management interface until it is rebooted.

Shenzhen Tenda Technology Co., Ltd’s Tenda AC1206 wireless router running firmware version v15.03.06.23 is affected. No other versions, vendors, or products were listed in the advisory.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the attack can be performed over the network by sending a specially crafted HTTP request to the device. The lack of a published CVSS score prevents an exact severity rating, yet the DoS impact is significant for any organization that relies on continuous network connectivity. Organizations should treat the flaw as a high‑priority issue until a patch is applied.