The flaw is a classic buffer overflow triggered in the fromRouteStatic routine located in the /goform/RouteStatic web service of Tenda F456 routers. By supplying an oversized argument to the page parameter, an attacker can corrupt stack memory and potentially execute arbitrary code on the device. The vulnerability directly impacts confidentiality, integrity and availability of the router and all devices on the network it serves. It is a type‑I and overrun flaw as classified under CWE‑119 and CWE‑120.

Tenda F456 routers running firmware version 1.0.0.5 are vulnerable. No other firmware revisions or product variants are listed as affected; however, any device identified as "Tenda F456" with this exact firmware build should be considered at risk.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests the flaw has not been widely exploited yet, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring access to the router’s web interface. An attacker must be able to send malicious HTTP requests that include the crafted page parameter; no local privilege escalation is required. Once successful, the attacker can gain full control of the router and potentially pivot to other network assets.