This vulnerability affects Tenda HG7HG9 and HG10 devices with firmware 300001138_en_xpon. It arises from improper handling of the blkDomain argument in the formDOMAINBLK function, causing a stack-based buffer overflow. The vulnerability is remotely exploitable without authentication or user interaction, as indicated by the CVSS vector. The impact includes potential high confidentiality, integrity, and availability compromise. No official patch or vendor advisory is currently available, and no exploits have been reported in the wild.

Successful exploitation can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause denial of service. The CVSS score of 9.3 reflects critical impact on confidentiality, integrity, and availability. However, no known exploits have been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interfaces to trusted sources only and monitor for suspicious activity targeting the formDOMAINBLK function.