A stack‑based buffer overflow exists in the formWifiMacFilterSet function of Tenda i3 firmware 1.0.0.6(2204). By manipulating the index argument supplied to /goform/WifiMacFilterSet, an attacker can overflow the device’s stack and potentially execute arbitrary code. The flaw is exploitable remotely, and public exploit code has already been released. Consequently, an adversary could compromise the device’s network functions, leading to data loss, service disruption, or further lateral movement.

Tenda i3, firmware version 1.0.0.6(2204).

The CVSS score is 8.7, indicating high severity. EPSS is below 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Despite this, the exploit is publicly available and can be launched remotely, allowing attackers to gain control of the device by exploiting the stack overflow and bypassing normal authentication constraints.