The vulnerability is a buffer overflow in the fromVirtualSer function of the httpd component, triggered by manipulating the menufacturer/Go argument in /goform/VirtualSer. A remote attacker can supply a crafted payload that overflows internal buffers, potentially leading to arbitrary code execution on the device. The flaw maps to CWE-119 and CWE-120 and carries a CVSS score of 8.7, indicating a high severity. The description explicitly states that the exploit is possible remotely and has been publicly disclosed, underlining the likelihood of exploitation once accessed.

The affected system is the Tenda F456 router, specifically firmware version 1.0.0.5. No additional platforms or versions are listed, so the issue is limited to this firmware revision. Users of later or earlier firmware versions are not reported as affected.

The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild, yet the vulnerability’s high CVSS score and remote nature mean that a determined attacker could still target the device if it is exposed on a network. The vulnerability is not catalogued in the CISA KEV list, but the publicly disclosed exploit code indicates that remote attackers could attempt to trigger the overflow via HTTP requests to the device’s /goform/VirtualSer endpoint.