This vulnerability affects Tenda HG7HG9 and HG10 devices running version 300001138_en_xpon. The issue is a stack-based buffer overflow in the formPPPEdit function due to improper validation of the encodename argument. An attacker can remotely send crafted input to cause the overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or mitigation has been documented.

Successful exploitation could allow a remote attacker to execute arbitrary code or cause a denial of service on affected Tenda devices. The vulnerability impacts confidentiality, integrity, and availability at a high level. Although an exploit is publicly available, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected devices and monitor for unusual activity. Avoid exposing the management interface to untrusted networks. Follow vendor channels for updates on patches or official mitigations.