A buffer overflow exists in the function fromAdvSetWan, which processes the wanmode/PPPOEPassword argument in the /goform/AdvSetWan endpoint of Tenda F453 httpd. An attacker can supply crafted input that overflows a local buffer and potentially injects code or corrupts execution flow, resulting in remote code execution. The flaw belongs to the characters classes of CWE‑119 and CWE‑120. According to the advisory, the exploit is publicly available and can be launched without the need for special privileges. The stated impact is loss of confidentiality, integrity, and availability of the affected device.

The affected device is the Tenda F453 wireless router running firmware version 1.0.0.3. No other products or firmware revisions are reported as vulnerable.

The CVSS score of 8.7 indicates high severity, while an EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote over an HTTP request to /goform/AdvSetWan, and no authentication requirements are mentioned, implying that any host capable of reaching the HTTP service can attempt exploitation.