A stack-based buffer overflow exists in the SafeMacFilter web interface of the Tenda 4G300 router. The flaw is triggered by an improperly validated argument to the /goform/SafeMacFilter endpoint, allowing an attacker to overflow a stack buffer and overwrite control data. This can give the attacker arbitrary code execution on the device, compromising confidentiality, integrity, and availability. The vulnerability is identified by CWE‑119 and CWE‑121.

The vulnerability is present in the US_4G300V1.0Mt_V1.01.42_CN_TDC01 firmware of the Tenda 4G300 router. Users of this model should verify whether their device is running this firmware version or earlier versions; newer releases from Tenda may have addressed the issue.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the existence of a published exploit and the remote nature of the attack suggest a significant risk. The attack can be carried out remotely by manipulating the page argument sent to /goform/SafeMacFilter, with no local access required. Given the high CVSS score and the presence of a proven exploit, the likelihood of exploitation in the wild is considered high. Monitoring for suspicious activity and applying a patch or workaround should be prioritized.