This vulnerability in Tenda M3 1.0.0.10 involves a buffer overflow in the setAdvPolicyData function of the Destination Handler component. An attacker can remotely trigger this by sending crafted input to the policyType argument, potentially leading to memory corruption. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation without privileges or user interaction. No official fix or vendor advisory is currently documented.

Successful exploitation can cause a buffer overflow, which may lead to arbitrary code execution or denial of service on the affected device. Given the remote attack vector and lack of required privileges, this vulnerability poses a significant risk to affected Tenda M3 devices running version 1.0.0.10. No confirmed exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable device's management interface to trusted sources only and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently available.