This vulnerability involves a stack-based buffer overflow in the fromRouteStatic function of the Tenda F451 firmware version 1.0.0.7. An attacker can remotely manipulate the 'page' argument in the /goform/RouteStatic endpoint to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known with an exploit published, but no official fix or patch has been disclosed by Tenda.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the network attack vector and no required privileges, the risk to exposed devices is significant. However, there is no indication that exploits are currently observed in the wild. The lack of an official patch increases the urgency for mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the /goform/RouteStatic endpoint or isolating the device within a secure network segment. Monitor vendor communications for updates on patches or official mitigations.