This vulnerability involves a stack-based buffer overflow in the Tenda AC18 router's Web Management Interface, within the function sub_45304 of the /goform/getRebootStatus endpoint. Remote attackers can manipulate the 'callback' parameter to overflow the stack buffer, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is present in firmware version 15.03.05.05. No official patch or vendor advisory has been published yet.

Successful exploitation could allow remote attackers to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. This compromises the integrity and availability of the router's management interface. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the Web Management Interface to the internet. Follow vendor communications closely for updates on patches or mitigations.