A stack-based buffer overflow exists in the httpd component of Tenda F453 firmware 1.0.0.3, specifically in the fromSetWifiGusetBasic function accessed via /goform/AdvSetWrlsafeset. Altering the mit_ssid argument can overflow the buffer, potentially allowing an attacker to inject and execute arbitrary code on the device, compromising confidentiality, integrity, and availability. The CVSS score of 8.7 indicates a high severity.

The vulnerability affects Tenda F453 devices running firmware version 1.0.0.3. No other versions or models are listed as impacted.

The attack vector is remote, with the exploit triggered through the device’s web interface. Public disclosure and available exploit code increase the risk, though the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The combination of a high CVSS score and remote trigger means an adversary could potentially compromise affected devices if they exploit the flaw before a patch is applied.