The vulnerability resides in the formWifiMacFilterGet handler of Tenda i12 firmware 1.0.0.6(2204). A malformed argument index can overflow a stack buffer, allowing an attacker to corrupt control data and execute arbitrary code. This flaw is a classic stack-based buffer overflow (CWE‑119, CWE‑121, CWE‑787) and, if exploited, would provide the attacker with full control over the router device.

Affected devices are Tenda i12 routers running firmware release 1.0.0.6(2204). No other Tenda products or firmware versions are listed as vulnerable.

The CVSS score of 8.7 denotes high severity, and though the EPSS probability is low (<1%) the flaw is publicly exploitable via the /goform/WifiMacFilterGet web endpoint. The exploit can be launched remotely without authentication, and the vulnerability is not currently in the CISA KEV catalog. An attacker could trigger the overflow from outside the local network, achieve remote code execution, and compromise the entire router.