CVE-2018-18732

CVE-2018-18732 describes a buffer overflow vulnerability in the web server (httpd) of several Tenda AC series routers, including models AC7, AC9, AC10, AC15, and AC18. This flaw occurs when processing the 'ntpServer' parameter in a POST request, where the input is directly copied to a stack-based local variable using strcpy, leading to an overwrite of the function's return address. The vulnerability carries a CVSS v3.0 score of 7.5 (HIGH), indicating that it can be exploited remotely over the network with low attack complexity and no user interaction required, potentially leading to a complete denial of service. While the EPSS score is low, suggesting a low probability of exploitation in the wild, the FAUCET Risk Score is 49/100. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, there is minimal community discussion or media coverage surrounding this CVE, suggesting it has not garnered significant attention from researchers or threat actors.