A stack-based buffer overflow exists in the fromAdvSetWan function of Tenda F451 firmware, triggered by manipulated wanmode or PPPOEPassword parameters sent to the /goform/AdvSetWan endpoint. The flaw belongs to CWE‑119 and CWE‑121 weaknesses, allowing an attacker to corrupt the stack and inject arbitrary code. Because the vulnerable interface is reachable over the network, exploitation can be performed from an external host without local access, enabling control over the device and its internal network resources.

The vulnerability affects Tenda F451 routers running firmware version 1.0.0.7_cn_svn7958. Only this specific firmware release is known to contain the vulnerability; newer releases may have addressed it.

The severity of the flaw is reflected in a CVSS score of 8.7, denoting high risk. Exploitation is feasible remotely, and public exploits are available, indicating that attackers could gain unrestricted control of the device. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the combination of remote attack vector, high CVSS, and public exploit suggests a substantial threat to confidentiality, integrity, and availability.