The vulnerability is a stack-based buffer overflow caused by improper validation of the index argument in the formWifiMacFilterGet function, which is exposed through the /goform/WifiMacFilterGet endpoint on Tenda i3 routers. The flaw allows an attacker to overflow the stack and execute arbitrary code, potentially compromising the device and any networks it connects to. It specifically involves the identified CWEs, 119 and 121, indicating unsafe buffer handling and stack exploitation.

This issue affects Tenda i3 routers running firmware 1.0.0.6(2204). The device model is the Tenda i3, and the vulnerability resides in the router’s web interface that handles WiFi MAC filter configuration.

With a CVSS score of 8.7, the vulnerability is classified as high severity. The EPSS score is below 1%, indicating a low probability of exploitation in the general population, although a publicly available exploit exists, which could increase actual risk in targeted attacks. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via HTTP requests to the vulnerable endpoint, allowing an attacker to inject a crafted index parameter that overflows the stack and yields code execution.