This vulnerability in Tenda F451 versions 1.0.0.7 and 1.0.0.9 arises from insufficient input validation in the formWriteFacMac function of the Web Management Interface, allowing remote OS command injection via the mac parameter. The flaw enables attackers to execute arbitrary commands on the underlying operating system remotely without user interaction or privileges beyond those required to access the interface. The CVSS 4.0 base score is 8.7, reflecting high impact and exploitability. Although exploit code is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation can lead to remote execution of arbitrary OS commands on the affected device, potentially compromising the router's integrity, confidentiality, and availability. This could allow attackers to control the device, disrupt network operations, or pivot to other internal systems. The vulnerability requires network access to the management interface but no user interaction or elevated privileges beyond access to the interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Web Management Interface to trusted networks only and monitor for suspicious activity. Consider disabling remote management if enabled. No vendor-provided patches or temporary fixes have been announced as of the publication date.