Authenticated memory corruption via unchecked funcpara1 write

Stack-based buffer overflow in Tenda AC7 15.03.06.44 allows remote authenticated users to corrupt memory through a crafted funcpara1 value. The formSetCfm handler at /goform/setcfm writes the attacker-controlled parameter beyond a stack buffer because it does not enforce the destination's capacity. Access to the management interface is required; the record establishes memory corruption but does not document whether the public proof achieves code execution or only a crash.