A buffer overflow occurs in the fromPPTPUserSetting function of the httpd component, triggered by manipulating the delno argument via the /goform/PPTPUserSetting interface. The overflow can corrupt memory, potentially allowing an attacker to execute arbitrary code on the device. The vulnerability is documented as exploitable remotely, meaning an attacker need only send a crafted request over the network to trigger the overflow and elevate their privileges to that of the device’s firmware code.

The flaw affects Tenda F456 routers running firmware version 1.0.0.5. No other Tenda or vendor versions were identified as vulnerable in the available data.

The CVSS score of 8.7 classifies the issue as high severity, and while the EPSS score is below 1%, indicating a low probability of widespread exploitation at present, it is not zero and could be targeted by threat actors with interest in the compromised platform. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack vector and lack of mitigations could still pose significant risk if the device is exposed to untrusted networks.