This vulnerability exists in the Tenda AC12 router firmware version 15.03.06.23_multi_TD01. The flaw is a buffer overflow in the formSetRebootTimer function of the /goform/SetSysAutoRebbotCfg endpoint in the HTTP web management interface. An attacker can remotely manipulate the rebootTime argument to cause a buffer overflow condition. The vulnerability has been publicly disclosed, but there is no official remediation or patch available as of the publication date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a remote attacker to cause a buffer overflow, potentially leading to denial of service or arbitrary code execution on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability of the device. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor Tenda's official channels for updates. Until a patch is available, restricting access to the web management interface from untrusted networks may reduce exposure.