The vulnerability exists in the formwrlSSIDset function exposed via the /goform/wifiSSIDset endpoint of Tenda i3 firmware. Malicious manipulation of the index/GO argument leads to a stack-based buffer overflow. According to the vendor description, remote exploitation is possible, which may allow an attacker to execute arbitrary code or otherwise compromise the device's confidentiality and integrity.

The affected product is Tenda i3, specifically firmware version 1.0.0.6 (2204). No other versions are listed as vulnerable.

The CVSS score is 8.7, indicating high severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires remote access to the device's web interface and input manipulation, making it a remote vulnerability that could lead to remote code execution if successfully exploited.