This vulnerability in Tenda M3 1.0.0.10 involves a buffer overflow triggered by improper handling of the policyType argument in the setAdvPolicyData function of the Destination Handler component. The flaw allows remote attackers to execute a buffer overflow attack, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation without privileges or user interaction. No official fix or patch has been disclosed, and the device is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The vulnerability does not require user interaction or elevated privileges, increasing its risk. However, no known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device and monitor for any vendor updates. No vendor-provided mitigation or temporary fix is currently available.