A buffer overflow exists in the Tenda FH451 router when processing requests to the /goform/GstDhcpSetSer endpoint. The flaw allows an attacker to supply data that exceeds the intended buffer size, potentially overwriting control data on the stack and enabling arbitrary code execution or device compromise. The underlying weakness corresponds to CWE‑119 (improper memory handling) and CWE‑120 (unsafe stack manipulation).

The vulnerability impacts Tenda FH451 routers running firmware versions up to 1.0.0.9, inclusive. Users of earlier firmware revisions may also be vulnerable if the affected code is present. The fault occurs in the router's web‑based administration interface, which provides DHCP configuration through the referenced endpoint.

The CVSS score of 8.7 indicates a high severity level, while the EPSS score of less than 1% reflects a low probability of exploitation at this time. The flaw can be triggered remotely by sending a crafted request to the exposed web interface; based on the description, it is inferred that authentication may not be required, but this is not explicitly stated. Although the vulnerability is not listed in the CISA KEV catalog, the combination of remote attack surface and potential for full device takeover makes it a priority for remediation.