This vulnerability affects Tenda AC7 firmware version 15.03.06.44 and involves a stack-based buffer overflow in the fromSetSysTime function of the /goform/SetSysTimeCfg component. The issue arises from improper handling of the Time argument in a POST request, allowing remote attackers to trigger a buffer overflow condition. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code has been published, but no confirmed exploitation in the wild has been reported. No vendor patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. Given the high CVSS score and remote attack vector, this poses a significant risk to the confidentiality, integrity, and availability of the affected router. However, no confirmed active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface to trusted sources only. Monitor vendor communications for updates on patches or official mitigations.