This vulnerability is a classic buffer overflow in the httpd service of the Tenda F456 router. The flaw occurs in the fromWrlclientSet function in the /goform/WrlclientSet endpoint. A crafted HTTP request can overflow internal buffers, allowing an attacker to execute arbitrary code or crash the process. By gaining code execution, an attacker can compromise the router’s firmware, exfiltrate traffic, or use the device as a pivot for further attacks. The problem is identified as CWE-119 and CWE-120. The impact threatens confidentiality, integrity, and availability of the device and any network traffic routed through it.

Affected is the Tenda F456 router, firmware version 1.0.0.5. No other models or versions were explicitly listed.

The CVSS score of 8.7 indicates a high severity of remote code execution. The EPSS score of under 1% suggests that, as of the current data, the exploitation probability is low, and the vulnerability is not yet in CISA’s KEV list. However, the attack is remote and can be triggered via HTTP, making it reachable from the Internet. The buffer overflow allows arbitrary code execution, which is a critical risk to network security. Admins should consider the high potential impact when deciding remediation steps.