A buffer overflow in the frmL7ProtForm function of the Tenda F453 HTTP server can be triggered by carefully crafted ‘page’ parameters sent to /goform/L7Prot. The overflow allows an attacker to overwrite the stack and execute arbitrary code, potentially giving full control over the device. The flaw can be exploited remotely over HTTP, which means an attacker anywhere on the internet could reach the vulnerable endpoint if the router is exposed.

The vulnerability affects the Tenda F453 router running firmware version 1.0.0.3. No other firmware versions or Tenda device models are reported to be impacted based on the current CNA data.

The vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The flaw can be abused by sending a specially crafted HTTP request to the /goform/L7Prot path, which is reachable from the external network if the router’s web interface is not restricted. As the attack requires only remote access to the device’s management interface, it is feasible for adversaries without local network access. No additional preconditions or privileges are required beyond external accessibility.