A stack-based buffer overflow exists in the function that processes POST requests to the SetSysTimeCfg endpoint. By sending a crafted Time argument, an attacker can corrupt the stack, potentially leading to arbitrary code execution or a denial‑of‑service condition. The vulnerability is rated CVSS 8.7, indicating a high severity.

Tenda AC7 routers running firmware version 15.03.06.44 are affected. The flaw resides in the router’s web‑based configuration interface, which is exposed on the local network and, if reachable from the internet, can be contacted remotely.

The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is remote over the network through a standard HTTP POST request to /goform/SetSysTimeCfg, and exploit code has been published. The combination of a high CVSS score and low EPSS suggests a moderate overall risk that warrants prompt mitigation.