This vulnerability involves a stack-based buffer overflow in the fromSysToolChangePwd function of the /bin/httpd binary on Tenda AC10 devices running firmware version 16.03.10.10_multi_TDE01. The issue arises when the sys.userpass argument is manipulated remotely, causing a buffer overflow condition. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The vulnerability affects confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interface to trusted users only and monitor for unusual activity related to password change functions.