A stack-based buffer overflow was discovered in the Tenda i12 router firmware version 1.0.0.6(2204). The flaw originates in the vos_strcpy routine that processes the cmdinput parameter in the /goform/exeCommand endpoint. By supplying an oversized payload, an attacker can corrupt the stack and potentially execute arbitrary code, resulting in full remote compromise of the device. The weakness corresponds to common buffer overflow conditions (CWE‑119, CWE‑121, CWE‑787).

The vulnerability affects the Tenda i12 series of wireless routers when running firmware 1.0.0.6(2204). All devices that have not upgraded beyond this firmware level expose the vulnerable /goform/exeCommand handler and are susceptible to remote exploitation.

The flaw is rated high on the CVSS scale with a score of 8.7, underscoring its severity. However, the EPSS score is below 1%, indicating a low probability of widespread exploitation at present. Publicly released exploits are available, and the attack can be launched remotely over the network, likely via HTTP requests to the exposed endpoint. Because the condition is purely remote and requires no user interaction, it poses a significant risk to any exposed router. The vulnerability is not listed in the CISA KEV catalog, but its high impact warrants immediate attention.