A buffer overflow exists in the setAdvPolicyData function of the Destination Handler on the Tenda M3 router. By manipulating the policyType argument, an attacker can overwrite adjacent memory, yielding arbitrary code execution. This vulnerability is a classic example of CWE‑119 (Buffer Overflow) and CWE‑120 (Improper Validation of Array Index).

The flaw is present only in the Tenda M3 firmware version 1.0.0.10. No other firmware releases were identified as affected by the vendor or in the published advisory. Devices running newer firmware are not known to be impacted.

The issue carries a CVSS score of 8.7, which marks it as high severity. EPSS data is unavailable and the exploit is not listed in the CISA KEV catalog. The advisory states the exploit has been published and can be triggered remotely via the /goform/setAdvPolicyData interface, so an attacker only needs network reachability to the router’s administrative endpoint to attempt exploitation.