A stack-based buffer overflow exists in the formWrlExtraSet function of the Tenda FH451 router, triggered by the GO argument passed to the /goform/WrlExtraSet endpoint. The flaw arises due to insufficient input validation, allowing an attacker to overwrite memory on the device’s stack. While the official description does not explicitly confirm a successful code execution, the presence of a stack overflow and a published exploit strongly imply that an attacker could potentially gain arbitrary code execution or cause a denial of service. This vulnerability can be abused remotely without requiring authentication.

The issue is limited to the Tenda FH451 model running firmware 1.0.0.9, as specified in the CNA information. No additional affected versions are listed. Users of older or unpatched firmware should verify that they are not vulnerable.

With a CVSS score of 8.7, the vulnerability is considered high severity. The EPSS score is below 1 %, indicating that large-scale exploitation is currently uncommon, yet the availability of a published exploit means a remote attacker can launch an attack from any external network. Because the flaw is not included in the CISA KEV catalog, it is not officially flagged yet, but the combination of remote access, high severity, and potential for code execution warrants urgent attention.