This vulnerability arises from improper handling of the password field in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System firmware versions <= 5.16.1.33. Specifically, a buffer overflow occurs when the password exceeds 64 bytes, enabling remote attackers without authentication to execute arbitrary code on the device. The vulnerability is classified under CWE-120 (Buffer Overflow). No official patch or vendor advisory is currently provided, and no known exploits have been reported in the wild as of the publication date.

Successful exploitation allows remote, unauthenticated attackers to execute arbitrary code with potentially full control over the affected device. This compromises the confidentiality, integrity, and availability of the device and its network environment, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interfaces to trusted users only and monitor for unusual activity. Avoid using passwords longer than 64 bytes if possible.