A remote attacker can trigger a buffer overflow in the fromSafeClientFilter function of the Tenda F456 router by sending a specially crafted value for the menufacturer/Go parameter. The overflow may overwrite memory or program control flow, leading to arbitrary code execution or denial of service on the affected device. The vulnerability belongs to the Memory Corruption class, specifically CWE-119 and CWE-120 error types. No additional privileges or physical access is required; the attack is launched over the network, making it accessible to attackers who can reach the router’s management interface.

The vulnerability impacts the Tenda F456 router running firmware version 1.0.0.5. Users of this model and version are at risk. No other versions or models are listed as affected in the CNA data.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The exploitation path is straightforward: an attacker with network access to the router’s web interface can craft the malicious parameter and trigger the overflow. Because the affected code resides in the HTTP API, the threat is remote and does not require insider knowledge or privileged credentials.