This vulnerability affects the Tenda AC9 router firmware version 15.03.02.13. It arises from a stack-based buffer overflow in an unspecified function within the /goform/fast_setting_internet_set component that handles POST requests. By sending a crafted request manipulating the netWanType parameter, an attacker can cause a buffer overflow on the stack. The vulnerability is remotely exploitable and does not require user interaction. The CVSS 4.0 base score is 9.4, indicating critical severity. Exploit code is publicly available, though no known active exploitation in the wild has been reported.

Successful exploitation can lead to arbitrary code execution or denial of service on the affected device due to the stack-based buffer overflow. Given the remote attack vector and high CVSS score, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected device.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting access to the affected endpoint and network-level controls may reduce exposure.