This vulnerability affects Tenda F451 firmware version 1.0.0.7. The issue arises from the formWrlExtraSet function in the /goform/WrlExtraSet endpoint, where manipulation of the GO argument causes a stack-based buffer overflow. The vulnerability is remotely exploitable and does not require user interaction or elevated privileges. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact. No official patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. Since the vulnerability is remotely exploitable without authentication or user interaction, affected devices are at considerable risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should limit network exposure of affected devices, such as restricting access to the management interface and monitoring for suspicious activity. Follow vendor channels closely for updates and apply patches promptly once available.