Tenda WifiWpsStart index Parameter Buffer Overflow Attempt

Tim Peck@timpeck

•updated Nov 10, 2025•1•0•24

This rule detects attempts to exploit a buffer overflow vulnerability in the 'index' parameter of the '/goform/WifiWpsStart' endpoint on Tenda Wifi routers. The detection is triggered by HTTP POST requests to this specific URI containing 'index=' followed by a string of 100 or more characters, indicating an attempt to overflow the buffer. This vulnerability could lead to denial of service or arbitrary code execution.