The vulnerability is a buffer overflow in the HTTPD component of the Tenda F456 router. The fromSafeUrlFilter function in /goform/SafeUrlFilter improperly handles the page argument, allowing an attacker to overflow a buffer and potentially execute arbitrary code. It is identified as CWE‑119 (Improper Restriction of Operations within Bounds) and CWE‑120 (Buffer Overflow).

Tenda F456 router, firmware version 1.0.0.5. No other versions or revisions are noted in the available data.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests that, statistically, the probability of exploitation is low at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely; it is inferred that the exploit involves crafting malicious input to the vulnerable endpoint. Given that the exploit has been published, an attacker with network access to the device could trigger the overflow and execute code without further authentication. Its impact on confidentiality, integrity, and availability is significant, with the potential to compromise the entire device.