The vulnerability resides in the formwrlSSIDget function of the /goform/wifiSSIDget interface on the Tenda i12 router. By supplying an invalid argument index the function overflows a stack buffer, potentially allowing an attacker to overwrite control data and achieve arbitrary code execution. This type of flaw compromises confidentiality, integrity, and availability of the device and any connected network resources.

Affected devices are Tenda i12 routers running firmware version 1.0.0.6(2204). The flaw exists in the Tenda i12 Wi‑Fi module and is exploitable through the wireless management interface exposed by the router.

The flaw has a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, implying low probability of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the vulnerability can be triggered remotely via HTTP requests to the router’s web interface, and the publicly disclosed exploit suggests that attackers could remotely gain code execution on the device.