A stack‑based buffer overflow exists in the fromP2pListFilter function of the /goform/P2pListFilter endpoint. Manipulation of the page argument triggers the overflow, and the vulnerability can be exploited remotely from an external host. Successful exploitation would allow an attacker to execute arbitrary code on the device, compromising confidentiality, integrity, and availability of the router and potentially of the network it serves.

The flaw affects Tenda F451 devices running firmware version 1.0.0.7. No other firmware versions or models are listed as affected.

The CVSS score of 8.7 classifies this as a high severity issue. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known large‑scale attacks yet. However, the exploit has been publicly disclosed and is likely accessible to attackers who can reach the device’s web interface, especially if it is exposed to the internet or an untrusted local network. The attack vector is inferred to be remote, via HTTP requests to the router’s management interface.