The vulnerability is a stack-based buffer overflow in the formQuickIndex function of the /goform/QuickIndex POST handler. By sending a specially crafted PPPOEPassword value an attacker can overwrite return addresses on the stack, achieving arbitrary code execution on the device. The flaw is exploitable from the network without local access and an exploit is publicly available.

Tenda AC6 routers running firmware 15.03.05.16 are affected. No other firmware versions were listed as impacted. The fault exists in the POST request handling component for QuickIndex.

The CVSS score of 8.7 indicates high severity, while the EPSS of less than 1% suggests the likelihood of exploitation is low but still non-zero, and the vulnerability is not yet in the CISA KEV database. The attack vector is remote over HTTP, requiring access to the router’s web interface and knowledge of the PPPOEPassword parameter. Because an exploit is publicly available, any device without a patch could be compromised if the endpoint remains exposed.