The flaw resides in the websGetVar handler for changing passwords, where unsafe handling of the oldPwd, newPwd, and cfmPwd parameters permits a stack-based buffer overflow. This overflow can enable an attacker to execute arbitrary code on the device, compromising its confidentiality, integrity, and availability. The weakness is a classic stack corruption identified as CWE‑119 and CWE‑121.

The affected hardware is the Tenda AC15 router running firmware version 15.03.05.18. Users deploying this model with that firmware are at risk; newer firmware revisions may have been patched.

With a CVSS base score of 8.7, the vulnerability is considered high severity. No EPSS score is posted, but the exploit is publicly available and remote attackers can trigger it from outside the local network. The vulnerability does not appear in the CISA KEV catalog yet, but the presence of a public exploit increases the likelihood of real-world attacks.