This vulnerability in Tenda AC15 firmware 15.03.05.19 involves a stack-based buffer overflow in the formSetCfm function of the POST Request Handler component, specifically in the /goform/setcfm file. Remote attackers can manipulate the funcpara1 parameter to cause a buffer overflow, potentially leading to code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no known active exploitation has been reported. No patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda AC15 device. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability. However, no confirmed active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface. Monitor vendor channels for updates and apply patches promptly once available.