This vulnerability in Tenda F451 1.0.0.7 involves a stack-based buffer overflow in the fromDhcpListClient function of the httpd component. The flaw is triggered by manipulating the 'page' argument in the /goform/DhcpListClient endpoint, enabling remote code execution potential. The CVSS 4.0 score of 8.7 indicates high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known, but no official fix or mitigation has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda F451 device. Given the stack-based buffer overflow nature and the high CVSS score, the impact is significant, potentially compromising device integrity and availability. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, especially restricting access to the /goform/DhcpListClient endpoint. Monitor vendor channels for updates and apply patches promptly once available.