This vulnerability affects the Tenda F451 router firmware versions 1.0.0.7 and 1.0.0.9. The issue is an OS command injection in the formWriteFacMac function within the /goform/WriteFacMac web management interface endpoint. By manipulating the mac parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, but with high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected Tenda F451 devices, potentially leading to full compromise of the device. This can impact device confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication or user interaction. Public exploit code is available, increasing the risk of attack, although no confirmed in-the-wild exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's web management interface from untrusted networks and monitor for unusual device behavior. No official vendor mitigation or workaround has been published at this time.