Technical impact
A stack-based buffer overflow exists in the /goform/wifiSSIDset endpoint of the Tenda W6‑S router. The formwrlSSIDset function uses sprintf to copy the unvalidated 'GO' and 'index' parameters into a fixed 64‑byte stack buffer, allowing an attacker to overflow the stack and potentially execute arbitrary code, corrupt memory, or crash the device. This flaw can compromise confidentiality, integrity, and availability of the router and any networks it manages.
Affected Systems
The vulnerability affects devices running firmware version 1.0.0.4(510) on the Tenda W6‑S model. No additional vendor or product variants are listed.
Risk and Exploitability
The CVSS score of 9.8 marks this weakness as critical. Although the EPSS score is below 1%, indicating a low current exploit probability, the lack of a KEV listing does not reduce the risk; attackers could still target the exposed endpoint to exploit the buffer overflow. The likely attack vector is unauthenticated remote exploitation via the /goform/wifiSSIDset API, requiring crafted GET or POST parameters. Given the severity and potential impact, the threat remains high even if actual exploitation attempts are uncommon.
