This vulnerability involves a stack-based buffer overflow in the asp_voip_OtherSet function within the /boaform/voip_other_set component of the Tenda HG7HG9 and HG10 Web Management Interface. By manipulating the funckey_transfer argument remotely, an attacker can overflow the stack buffer, potentially leading to control over program execution. The issue affects firmware version 300001138_en_xpon. The CVSS v4.0 score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is published but lacks an official remediation level or patch information.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, which may result in arbitrary code execution or denial of service on affected Tenda HG7HG9 and HG10 devices. This compromises the confidentiality, integrity, and availability of the device's Web Management Interface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Web Management Interface to trusted networks only and monitor for unusual activity related to the funckey_transfer parameter. Avoid exposing the management interface to untrusted networks.