A stack-based buffer overflow was identified in the setMacFilterCfg endpoint of the MAC filtering feature on Tenda A18 Pro devices. The flaw originates from improper handling of the deviceList parameter in the sub_423B50 function, which can overwrite memory on the stack. If successfully triggered, this vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service, compromising the device’s confidentiality, integrity, and availability. The weakness is classified under CWE-119 and CWE-121.

The vulnerability affects the Tenda A18 Pro model running firmware version 02.03.02.28. No other firmware versions or models are listed as affected in the available data.

The CVSS score of 8.7 indicates a high-risk severity. Although EPSS data is not available, the vulnerability has been publicly disclosed and can be exploited remotely without authentication, which increases the likelihood of real-world attacks. The lack of inclusion in the KEV catalog does not diminish the risk, as attackers can already craft attacks targeting the exposed deviceList parameter. The threat is serious for any business or home environment relying on the described device.