This vulnerability affects Tenda F453 firmware version 1.0.0.3. The flaw is a buffer overflow in the fromqossetting function within the /goform/qossetting endpoint. Remote attackers can trigger the overflow by sending crafted input in the qos argument, potentially causing memory corruption. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation without user interaction or privileges. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation of this buffer overflow could allow remote attackers to cause memory corruption, which may lead to denial of service or potentially arbitrary code execution on the affected device. Given the high CVSS score and remote attack vector, the impact on confidentiality, integrity, and availability is high. However, no confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the vulnerable endpoint and monitor for unusual activity. Avoid exposure of the device management interface to untrusted networks. Follow up with Tenda for any forthcoming security updates or patches.