The vulnerability is a buffer overflow in the formWrlExtraSet function of the /goform/WrlExtraSet HTTP endpoint in Tenda F456 firmware 1.0.0.5. It is triggered by a crafted value sent in the Go argument, and the missing bounds check allows memory corruption that can lead to arbitrary code execution once the request reaches the device. The weakness is classified as CWE‑119 and CWE‑120, indicating improper buffer bounds checking and uncontrolled buffer usage. Based on the description, it is inferred that an attacker who can reach the device’s web interface can manipulate input to achieve code execution, potentially allowing full control of the router.

Tenda F456 routers running firmware version 1.0.0.5 are affected. The issue is limited to this model’s httpd implementation; newer firmware releases are presumed to have incorporated the fix. Based on the description, it is inferred that operators with devices exposed to external networks or untrusted traffic are particularly at risk.

The CVSS score of 8.7 indicates high severity. The EPSS score is below 1%, but the CVE notes that an exploit has already been published, suggesting real-world usage may be higher than the EPSS statistic implies. The vulnerability is not listed in the CISA KEV catalog, but the availability of a published exploit and the ability to reach the vulnerable endpoint over HTTP make the attack likely in environments where the device is exposed. Based on the description, the attack vector is remote through the web management interface, requiring network connectivity to the router and the ability to send HTTP POST requests to /goform/WrlExtraSet.