Technical impact
The reported issue is a stack-based buffer overflow triggered by the fromAddressNat function in the HTTP daemon of the Tenda F451 router. When an attacker supplies an overly long entry string to the /goform/addressNat endpoint, the input is copied into a fixed-size buffer without bounds checking, corrupting the call stack. This flaw can be exploited from a remote host to achieve arbitrary code execution, compromising the confidentiality, integrity, and availability of the device and any networks it serves.
Affected Systems
Only the Tenda F451 router, specifically firmware version 1.0.0.7, is affected. The vulnerability resides in the httpd component handling the addressNat configuration page. No other firmware revisions or models are listed as impacted.
Risk and Exploitability
The CVSS base score of 8.7 classifies the flaw as high severity. Although an exploit prediction score is not available and the vulnerability is not listed in CISA's KEV catalog, publicly released proof‑of‑concept code exists, indicating that the attack has been demonstrated in the wild. Remote attackers can trigger the overflow over the network by crafting HTTP requests, making the risk significant for any exposed router.
