A buffer overflow flaw exists in the formWrlsafeset function of the Tenda F453 router’s web administration interface. By manipulating the mit_ssid_index argument sent to /goform/AdvSetWrlsafeset, an attacker can overflow a memory buffer, potentially allowing arbitrary code execution on the device. The flaw falls under non‑local buffer overflow weaknesses such as CWE‑119 and CWE‑120, and it can be triggered entirely over the network without requiring local access.

The vulnerability impacts Tenda routers manufactured as the F453 model, specifically firmware version 1.0.0.3. Devices with earlier firmware may be unaffected, but no versions below 1.0.0.3 are confirmed to be safe. Any system running this firmware and exposed to the Internet is therefore at risk.

The CVSS score of 8.7 classifies this issue as high severity. An EPSS value of less than 1 % indicates that, while exploitation is technically possible, it is not widely automated. The flaw is not yet listed in the CISA KEV catalog. Because it can be triggered remotely via the web interface, the attack surface is broad and the potential impact is full remote code execution. Publicly available proof‑of‑concept exploits confirm that a remote attacker can gain control of the device, underscoring the urgency of a fix.