The flaw is a stack overflow in the list1 parameter of the fromDhcpListClient function in the Tenda FH451 firmware. The vulnerability allows an attacker to craft an HTTP request that overflows the stack and causes the device to crash, rendering the network interface unavailable. This results in a denial of service to all users attached to the device.

Shenzhen Tenda Technology Co., Ltd Tenda FH451 firmware 1.0.0.9 is affected. No other versions are listed as impacted. The product is a consumer wireless router.

The CVSS score of 7.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Based on the description it is inferred that the attack vector is remote over the network via unauthenticated HTTP traffic, and the exploitation does not directly affect confidentiality or integrity but can quickly cause service interruption. No public exploits are documented, but the simplicity of the payload suggests that an attacker with basic knowledge of the device’s HTTP interface could trigger it.