The vulnerability resides in the fromP2pListFilter function of the /goform/P2pListFilter endpoint on Tenda F456 routers. Manipulating the "menufacturer/Go" argument causes a buffer overflow, which can be triggered remotely via the router's web interface. Attackers who exploit the overflow can execute arbitrary code on the device, potentially leading to full control over the router and the networks it manages. Publicly available exploits indicate that the weakness is readily usable by threat actors.

Vendors and products: Tenda routers model F456, specifically firmware version 1.0.0.5. No other versions or models are listed as affected in the available data.

The CVSS score of 8.7 denotes high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at a given moment, though the existence of public exploits means the risk remains non‑negligible. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires remote access to the router’s management interface, typically over the local network or via a compromised router configuration portal. Attackers must supply a crafted request with an oversized "menufacturer/Go" parameter to trigger the overflow.