A buffer overflow exists in the fromwebExcptypemanFilter function of the httpd component on the Tenda F456 router. Manipulation of the page argument in the /goform/webExcptypemanFilter endpoint can overflow the buffer, allowing an attacker to execute arbitrary code. This type of vulnerability is classified as a memory corruption flaw (CWE‑119/120) and, when successfully exploited, can lead to full compromise of the device, including data exfiltration, denial of service, or further network intrusion.

The vulnerability affects the Tenda F456 model running firmware version 1.0.0.5. No other product versions are listed as impacted. The issue resides in the device’s web server, meaning any system exposing this interface could be targeted.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1 % shows a low probability of exploitation in the wild. The exploit is publicly available, yet the device is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can remotely trigger the flaw by sending a crafted HTTP request to the /goform/webExcptypemanFilter endpoint when the web interface is reachable.