A stack-based buffer overflow exists in the qossetting feature of Tenda F456 router firmware 1.0.0.5. The flaw occurs when the 'page' argument to the fromqossetting function in /goform/qossetting is processed, allowing an adversary to place crafted input that overruns a local stack buffer. Successful exploitation can lead to arbitrary code execution on the device, compromising confidentiality, integrity, and availability of the network.

The vulnerability impacts the Tenda F456 router product, version 1.0.0.5. Only devices running this specific firmware build contain the flaw. No other Tenda products or versions are indicated as affected in the available data.

This flaw carries a CVSS score of 8.7, classifying it as high severity. The EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue, so the exact likelihood of exploitation in the wild cannot be quantified from the data. The description confirms that the exploit is remote, and public proof‑of‑concept code has been published, implying that an attacker can trigger the buffer overflow from outside the network by accessing the /goform/qossetting endpoint. The lack of a public patch means that systems remain exposed until an official firmware update is applied.