The flaw is a stack‑based buffer overflow in the formWrlsafeset function of the /goform/AdvSetWrlsafeset endpoint on Tenda F456 routers. An attacker can manipulate the mit_ssid parameter to overflow the stack, enabling execution of arbitrary code from a remote location. This weakness involves both buffer overrun and stack corruption, allowing a crafted request to hijack control flow.

The vulnerability exists in Tenda F456 routers running firmware version 1.0.0.5. No other vendors or product versions are listed as affected.

An exploit for this flaw has been published and can be triggered remotely, indicating that attackers can directly target affected devices. The CVSS score of 8.7 signals a high severity level. While explicit modern exploitation probability data is unavailable, the existence of a public exploit demonstrates likely abuse. The flaw is not recorded in the Common Exploited Vulnerabilities catalog, but the remote code execution potential remains a critical risk.