The vulnerability is a stack buffer overflow located in the fromDhcpListClient function of the /goform/DhcpListClient HTTP handler in Tenda F456 firmware 1.0.0.5. When an attacker supplies an oversized page parameter, the unmanaged input overwrites adjacent memory, enabling arbitrary code execution on the device. This flaw classifies under CWE‑119 and CWE‑120 and has a CVSS score of 8.7, indicating high severity.

Only the Tenda F456 router running firmware version 1.0.0.5 is affected. No other Tenda models or firmware versions are listed as vulnerable, and the CWE identifies the flaw as a buffer overflow in a web‑based configuration endpoint.

The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation probability is low at this time. Nevertheless, the flaw can be triggered remotely through the router’s web interface, so an attacker with network access can deliver a malicious payload. The high CVSS score and public disclosure of exploit code call for prompt attention, especially in environments where the router is exposed to the Internet.