This vulnerability involves a stack-based buffer overflow in the fromSysToolChangePwd function of the /bin/httpd binary in Tenda AC10 firmware version 16.03.10.10_multi_TDE01. An attacker can remotely manipulate inputs to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits have been reported in the wild.

Successful exploitation could allow a remote attacker to execute arbitrary code or cause a denial of service on affected Tenda AC10 devices. The vulnerability impacts confidentiality, integrity, and availability of the device. Multiple endpoints running the vulnerable firmware version may be affected. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.