A vulnerability exists in the UploadCfg function of the Tenda A15 router firmware 15.13.07.13. The function improperly handles the File argument, leading to a stack‑based buffer overflow that can be triggered remotely. This flaw corresponds to CWE‑119 and CWE‑121 and can allow an attacker to execute arbitrary code on the device, potentially taking full control of the router. The description confirms the overflow is exploitable from outside the local network and that an exploit has already been disclosed to the public.

The issue affects the Tenda A15 wireless router with firmware version 15.13.07.13. No other versions are listed, so the vulnerability is specific to this build.

The CVSS score of 9.3 places this flaw in the Critical severity range. The EPSS indicates a 4% probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Because the vulnerability resides in a remote-accessible CGI interface, a threat actor with external network reach could launch the attack without requiring prior login credentials. The high severity and publicly available exploit code mean a rapid response is warranted.