A stack‑based buffer overflow exists in the fromexeCommand function of the Tenda F456 router. When the cmdinput parameter of the /goform/exeCommand endpoint is crafted, the overflow can modify control flow, leading to arbitrary code execution. The vulnerability maps to CWE‑119 (Buffer Overflow) and CWE‑121 (Stack‑Based Buffer Overflow), confirming that the flaw directly exploits stack corruption. If successfully exploited, an attacker could gain complete control of the router, compromising network security and potentially affecting all devices connected to it.

The only explicitly vulnerable configuration is the Tenda F456 router running firmware 1.0.0.5. No other firmware versions are listed as affected, so the scope is limited to this specific release unless further updates indicate otherwise.

The CVSS base score of 8.7 places the issue in the High severity range, and the publicly available exploit confirms that the vulnerability can be triggered remotely. EPSS data is not available, so the precise likelihood is unknown, but the remote attack vector makes it readily exploitable by adversaries with network access. The vulnerability is not listed in the CISA KEV catalog, so it is up to each organization to assess its impact based on exposure to this router model.