This vulnerability exists in the Tenda AC1206 router firmware version 15.03.06.23_multi_TD01 within the httpd web management interface. Specifically, the set_device_name function in /goform/SetOnlineDevName improperly handles the devName argument, leading to a stack-based buffer overflow. This flaw can be exploited remotely without user interaction, enabling potential remote code execution or denial of service. Although an exploit has been made public, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on the affected device with limited privileges, potentially leading to device compromise or denial of service. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no known active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to the web management interface to trusted networks only and monitor for unusual activity. No official remediation or temporary fix has been provided by the vendor as of now.