The vulnerability resides in the formSetAutoPing handler of the Tenda i3 firmware 1.0.0.6(2204). When an attacker manipulates the ping1 and ping2 parameters, a stack-based buffer overflow is triggered, potentially allowing arbitrary code execution on the device. The flaw is a classic CWE‑119/121 buffer overrun and could compromise the entire router.

Tenda i3 routers running firmware version 1.0.0.6(2204). The device is marketed by Tenda and accessible via the web interface under /goform/setAutoPing.

The CVSS score of 8.7 reflects a high‑severity vulnerability that can be exploited remotely, enabling attackers to manipulate the ping1 and ping2 parameters and trigger a stack-based buffer overflow. EPSS indicates <1% likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog, but publicly available exploits exist. An attacker can reach the vulnerable endpoint from any external network, manipulate the arguments, and may gain full control of the router.