This vulnerability in Tenda F451 1.0.0.7 involves a stack-based buffer overflow triggered by manipulating the 'entrys' argument in the fromAddressNat function within the /goform/addressNat endpoint of the httpd component. The flaw allows remote attackers to overflow the stack, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known with exploit code available, but no official patch or vendor advisory has been published to date.

Successful exploitation can lead to remote code execution or denial of service on affected Tenda F451 devices running firmware version 1.0.0.7. The vulnerability is exploitable remotely without authentication or user interaction, increasing risk. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface and monitoring for unusual activity. Avoid using version 1.0.0.7 of Tenda F451 firmware where possible.