A stack-based buffer overflow exists in the WrlclientSet function of Tenda F453 firmware 1.0.0.3. The vulnerability is triggered by manipulating the GO argument in the /goform/WrlclientSet endpoint, allowing an attacker to overflow the stack and potentially execute arbitrary code. The exploit is reported to be usable remotely and is publicly available. The attacker could compromise the device, gaining control and potentially using it in a botnet or for further attacks. The impact covers confidentiality, integrity, and availability of the firmware and network the device protects.

The affected system is the Tenda F453 router using firmware version 1.0.0.3. No other firmware revisions or models are listed as impacted. Vendors or users deploying the F453 with this firmware should treat the device as vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, though the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote via HTTP/TCP, where an attacker crafts requests to the /goform/WrlclientSet endpoint and supplies a malicious GO parameter. Successful exploitation would require network access to the router’s web interface and correct authentication or insufficient authentication checks.