A buffer overflow occurs in the DhcpListClient handler of the httpd component on the Tenda F453 router. By manipulating the page argument to the /goform/DhcpListClient interface, an attacker can overflow a server‑side buffer during request parsing. This memory corruption can be used to execute arbitrary code with the privileges of the web server process, allowing full compromise of the device. The exploit is publicly disclosed and can be performed remotely through the router’s web interface, making it a serious threat to confidentiality, integrity, and availability.

Tenda F453 routers running firmware version 1.0.0.3. No other models or firmware versions are currently known to be affected, but the vulnerability is identified by the specific CPE identifiers listed for this product.

The CVSS score 8.7 classifies this flaw as high severity. The EPSS value of <1% indicates a low predicted exploitation probability at present, yet the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote over the internet or local network, where an attacker can access the vulnerable /goform/DhcpListClient endpoint. Success requires only network access to the device’s web interface; no authentication is specifically required, making the attack relatively straightforward for motivated adversaries.