The vulnerability is a classic buffer overflow located in the frmL7ImForm function of the /goform/L7Im page on Tenda F456 firmware 1.0.0.5. An attacker can supply an overly long or malformed page argument, causing memory corruption and potentially allowing arbitrary code execution. The weakness is classified as CWE-119 and CWE-120, indicating a lack of bounds checking on input data. Such a flaw can compromise confidentiality, integrity, and availability of the device and the network it governs.

Tenda F456 routers running firmware version 1.0.0.5 are affected. No other Tenda models or firmware revisions are implicated in the current advisory.

The CVSS score of 8.7 reflects a high severity and the publicly disclosed exploit implies a realistic risk of remote exploitation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring network connectivity to the router’s web interface. Once accessed, an attacker could trigger the overflow and potentially install malware, gain full control of the device, or disrupt network services.