This vulnerability in Tenda HG3 2.0 involves a stack-based buffer overflow triggered by improper handling of the destNet argument in the formUploadConfig function within /boaform/formIPv6Routing. The flaw allows remote attackers to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation with no required privileges or user interaction. No official fix or patch has been documented, and the vendor has not provided remediation guidance.

Successful exploitation can lead to memory corruption via stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause denial of service on affected Tenda HG3 devices running version 2.0. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been confirmed as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider disabling vulnerable functionality if possible or isolate affected devices from untrusted networks to reduce exposure.