The flaw is a stack–based buffer overflow in the addStaticRoute function of the Tenda G0 HTTPD management interface, where a specially crafted staticRouteNet argument can overflow a local buffer. The CVE description does not state the exact effect on the program’s control flow; it only indicates that the overflow could lead to an unspecified outcome, such as a crash or potential code execution. The description does not confirm that return addresses are overwritten, so any claim about hijacked control flow is an inference based on typical stack‑overflow behavior.

Vulnerable devices are Tenda G0 routers that run firmware versions released on or before 20260625. The affected component is the HTTPD web‑management interface, specifically the /goform/module endpoint handling the addStaticRoute call.

The CVSS score of 8.7 signals high severity, and the vulnerability is exploitable remotely over the network without local access. Although the EPSS score is not available, public exploit code has been released, indicating that attackers could actively target this flaw. The vulnerability is not listed in the CISA KEV catalog, but the combination of remote attack capability, high severity and available exploit materials results in a significant risk for exposed devices.