The vulnerability resides in the httpd component of the Tenda F456 router, specifically the fromAdvSetWan function exposed via /goform/AdvSetWan. By manipulating the wanmode argument an attacker can trigger a buffer overflow, potentially enabling arbitrary code execution or denial of service. The weakness is identified by CWE‑119 and CWE‑120 and represents a serious integrity compromise if successful.

Products affected are the Tenda F456 router running firmware version 1.0.0.5. No other affected firmware or products are listed.

This flaw has a CVSS score of 8.7, indicating high severity. The EPSS score is reported as less than 1%, suggesting a very low probability of exploitation at the time of analysis, but the exploit has been made publicly available, so the risk is non‑negligible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via an HTTP request to the vulnerable endpoint. An attacker with network access to the device’s web interface could craft a payload that abuses the buffer overflow to gain unauthorized control.