A stack-based buffer overflow flaw has been found in the fromVirtualSer function of the VirtualSer component within the Tenda F453 firmware 1.0.0.3. The vulnerability is rooted in improper handling of user‑supplied input, which violates both the buffer overflow (CWE‑119) and stack-based buffer overflow (CWE‑121) criteria, allowing an attacker to corrupt the stack and potentially execute arbitrary code with the privileges of the vulnerable process.

Devices affected are Tenda F453 routers running firmware version 1.0.0.3. The flaw resides in the Parameters Handler component exposed via the web administration interface, and any router that has not yet received an updated firmware will remain vulnerable.

The vulnerability carries a high CVSS score of 8.7, and current exploit probability is reported as less than 1%. It is not listed in the CISA Known Exploited Vulnerabilities catalog, but the exploit is publicly disclosed and can be triggered remotely by sending a specially crafted request to the VirtualSer endpoint. Successful exploitation would compromise the device’s confidentiality, integrity, and availability.