A vulnerability was identified in the Tenda F451 router firmware 1.0.0.7_cn_svn7958, specifically in the fromGstDhcpSetSer function of the httpd component. The function fails to properly validate the `dips` argument, allowing a crafted HTTP request to the /goform/GstDhcpSetSer endpoint to overflow a buffer. This flaw could lead to memory corruption. While the CVE description does not explicitly state the resulting effect, publicly available exploit information demonstrates that the overflow can be triggered remotely through HTTP requests, confirming that the vulnerability is exploitable over the network.

Tenda F451 routers running firmware 1.0.0.7_cn_svn7958 are impacted. The vulnerability exists only in this specific build exposed at /goform/GstDhcpSetSer and there is no evidence of other affected versions.

The CVSS score of 8.7 reflects a high severity, while no EPSS score is provided, leaving the current exploitation likelihood unclear. Nevertheless, the flaw is accessed via remote HTTP requests and a public exploit is available, indicating that attackers can reach the target over the network. The vulnerability is not listed in CISA’s KEV catalog, but the public exploit makes the threat real, and immediate mitigation is advised.