The vulnerability is a stack-based buffer overflow in the fromNatStaticSetting function of the /goform/NatStaticSetting endpoint. By manipulating the page argument, an attacker can trigger a memory corruption that can result in arbitrary code execution on the device. The description confirms that the attack can be launched remotely and that a public exploit is already available.

Affected device is the Tenda F456 router running firmware version 1.0.0.5. No other versions are listed, so the risk applies to systems identified as Tenda F456 with that specific firmware release.

The CVSS score of 8.7 classifies this issue as high severity, indicating a significant threat to confidentiality, integrity, and availability. While the EPSS score is not available, the public nature of the exploit and the remote attack vector through the web interface increase the likelihood of real-world exploitation. The vulnerability is not listed in the CISA KEV catalog, but its severity and exposure warrant immediate attention.