A stack-based buffer overflow exists in the fromSetIpBind function of the /goform/SetIpBind page on Tenda F451 routers. By sending a crafted "page" argument from a remote location, an attacker can trigger a buffer overflow that may lead to arbitrary code execution. The vulnerability is classified under CWE‑119 (Buffer Overflow) and CWE‑121 (Stack Smashing). The exploit is publicly available and can be performed over the network without physical access.

Vulnerable equipment is the Tenda F451 router running firmware 1.0.0.7_cn_svn7958. No other product versions are listed, and the issue is specific to this firmware build.

The CVSS score of 8.7 indicates high severity, and although the EPSS score is not available, the public availability of the exploit and the ability to initiate the attack remotely make the risk significant. The vulnerability is not listed in CISA’s KEV catalog, but its remote nature and high CVSS warrant urgent attention. Exploitation requires only sending a malicious request to the router’s web interface; no special credentials are required, making the attack path comparatively straightforward.