The vulnerability arises from a buffer overflow in the fromPptpUserAdd function of the httpd component on Tenda F456. Manipulating the opttype/username argument can overwrite memory and grant an attacker arbitrary code execution. This flaw is a classic stack-based overflow (CWE‑119), which can compromise confidentiality, integrity, and availability of the device and potentially the networks it connects.

Tenda F456 1.0.0.5 is affected. Users running this firmware version should be aware that the buffer overflow can be triggered via remote HTTP requests to /goform/PPTPDClient.

The CVSS score of 8.7 reflects a high‑severity remote exploitation possibility. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. However, public exploit code is available, so the risk remains high. Attackers likely exploit the flaw by sending crafted requests to the device’s web interface, leveraging the buffer overflow to achieve remote code execution.