A stack-based buffer overflow exists in the Tenda F453 firmware in the function fromPptpUserAdd located within /goform/PPTPDClient. By supplying a crafted username or opttype parameter, an attacker can trigger the overflow and execute arbitrary code on the device. The vulnerability is a classic buffer overflow (CWE‑119, CWE‑121) and thus compromises the confidentiality, integrity, and availability of the affected device if successfully exploited.

The problem is present in Tenda F453 models running firmware version 1.0.0.3/3.As, as identified through vendor/product identifiers and the matching CPE entries for the firmware. No other versions have been explicitly listed as affected.

The CVSS base score of 8.7 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability can be triggered remotely through HTTP requests to the /goform/PPTPDClient endpoint. Publicly available exploits have been referenced, implying that the threat is real. The vulnerability is not currently listed in the CISA KEV catalog.