The vulnerability lies in the fromSafeUrlFilter function located in the /goform/SafeUrlFilter of Tenda F451 firmware 1.0.0.7_cn_svn7958. By manipulating the "page" argument, an attacker can trigger a stack-based buffer overflow. This overflow can allow the execution of arbitrary code and compromise the device. The exploit is remotely reachable and publicly available, indicating that an attacker does not need local access to launch the attack.

Tenda F451, firmware version 1.0.0.7_cn_svn7958. Network devices using this firmware are vulnerable until patched.

The CVSS score of 8.7 reflects a high severity issue, and although EPSS data is not available, publicly posted exploit code suggests a real and immediate threat. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce its importance. Attackers can exploit it remotely over the internet, making timely remediation essential.