Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/\qosIndex \request. This occurs because the \formQOSRuleDel\ function directly passes the parameter \qosIndex\ to strcpy without limit.