Tenda Router Buffer Overflow Attempt via exeCommand

Tim Peck@timpeck

•updated Nov 10, 2025•0•20

This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.