The vulnerability is a stack-based buffer overflow in the httpd component of the Tenda F453 router. The function “fromGstDhcpSetSer” in the web form endpoint “/goform/GstDhcpSetSer” does not adequately validate the “dips” argument, allowing an attacker to overflow the buffer and overwrite return addresses. This flaw is categorized as CWE‑119 and CWE‑120, indicating unsafe memory handling and lack of bounds checking. If successfully exploited, the overflow could enable an attacker to execute arbitrary code on the device, compromising its confidentiality, integrity, and availability.

Affected devices are Tenda F453 routers running firmware version 1.0.0.3, with the vulnerability present in the httpd component accessed via the web-based configuration interface.

The CVSS v3 score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a very low probability that exploitation is being observed in the wild at present. The vulnerability is not listed in the CISA KEV catalog, but it remains publicly available and could be exploited remotely through the router’s HTTP management interface. Based on the description, it is inferred that an attacker would need network connectivity to the device and the ability to manipulate the “dips” parameter via the exposed web form. Given the high severity score and the fact that the attack can be initiated remotely, the risk to organizations that expose these devices to the internet is significant.