A stack-based buffer overflow exists in the formwrlSSIDget function of Tenda i3 firmware 1.0.0.6(2204). Manipulating the index argument can overflow the buffer and corrupt the stack, enabling an attacker to execute arbitrary code. The vulnerability is tied to CWE-119 and CWE-121 and has been publicly exploited, meaning code execution is a realistic outcome when the remote attack is successful.

The affected product is the Tenda i3 router running firmware version 1.0.0.6(2204). No other versions are explicitly mentioned as vulnerable in the provided data, so users should verify their firmware against this identifier.

The CVSS score is 8.7, indicating a high severity risk. EPSS is reported as less than 1%, suggesting a low probability of exploitation in the near term, though the vulnerability is present in the wild and an exploit has been published. It is not listed in the CISA KEV catalog. The attack vector is remote, likely over the network, targeting the device’s web interface. Given the availability of a published exploit, the risk remains significant, especially if the router is exposed to untrusted networks.