The vulnerability is a stack-based buffer overflow in the Tenda AC15 firmware 15.03.05.19, triggered by manipulating the funcpara1 argument to the /goform/setcfm POST request handler. The overflow can corrupt critical control data on the stack and is likely to allow an attacker to execute arbitrary code on the device, resulting in full system compromise. The weakness is identified by CWE-119, CWE-121, and CWE-787.

Affected systems include the Tenda AC15 wireless router with firmware version 15.03.05.19. The vulnerability has been documented for the AC15 model and the specific firmware release, and only devices running this firmware are at risk.

The CVSS score of 8.7 indicates a high severity, and the EPSS score of less than 1% suggests current exploitation probability is low. However, the vulnerability has been publicly disclosed and can be initiated remotely. It is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning there is no confirmed exploitation in the wild yet. Nonetheless, the attack vector is remote and could be automated once the vulnerability is patched on the vendor side.