Technical impact
This vulnerability resides in the fromSafeEmailFilter function of the Tenda F451 firmware. By sending a crafted value in the page parameter to the /goform/SafeEmailFilter endpoint, an attacker can overflow a stack buffer and execute arbitrary code. The vulnerability can be triggered remotely, potentially allowing the attacker to gain full control over the device and compromise the confidentiality, integrity, and availability of the network.
Affected Systems
The affected hardware is the Tenda F451 router running firmware version 1.0.0.7. No other versions or firmware builds are listed as impacted.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not in the CISA KEV catalog, but the public disclosure of an exploit elevates the risk level. Because the attack can be initiated over the network by sending a malicious request to the vulnerable endpoint, the likelihood of exploitation is significant for exposed routers that have not applied a patch. The absence of a published mitigation makes the threat more pressing.
