A stack-based buffer overflow has been discovered in the setSchedWifi function exposed through the /goform/openSchedWifi endpoint on Tenda A18 Pro routers. The flaw enables an attacker to send a crafted request that overflows a stack buffer, which can lead to arbitrary code execution. The weakness is classified as a buffer overflow (CWE‑119) and a stack-based buffer overwrite (CWE‑121).

The vulnerability affects Tenda A18 Pro routers running firmware version 02.03.02.28. No other products or firmware versions are listed in the available data.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog, yet an exploit has already been published and can be used remotely. An attacker who can reach the router’s administrative interface over the network—either within a local network or from the internet if the interface is exposed—can trigger the overflow by sending a specially crafted request to /goform/openSchedWifi. Successful exploitation could grant the attacker full control over the device.