A buffer overflow exists in the fromRouteStatic function of the /goform/RouteStatic HTTP endpoint on the Tenda F453 router. By supplying a specially crafted "page" argument, an attacker can overflow a stack buffer, which may allow arbitrary code execution on the device. The vulnerability is rated CVSS 8.7, indicating a high‑severity flaw. The flaw is based on CWE-119 and CWE-120 weaknesses in the handling of input data.

The affected system is the Tenda F453 router running firmware version 1.0.0.3. No other products or versions are listed in the CNA data.

The risk is high because the flaw permits remote code execution, yet the EPSS score is below 1% and the vulnerability is not listed in the KEV catalog. However, the exploit is publicly available, so the threat remains real. An attacker can reach the vulnerable endpoint over the network, sending malicious input without needing any local access. Because the CVSS score is 8.7, the exploitation would grant extensive control over the router, potentially compromising network traffic and connected devices.