This vulnerability affects Tenda F451 firmware version 1.0.0.7, specifically the fromAddressNat function in the /goform/addressNat endpoint of the embedded httpd service. By sending a specially crafted request manipulating the 'entrys' parameter, an attacker can cause a stack-based buffer overflow. This flaw allows remote code execution due to improper input validation and buffer management. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known, but no official patch or vendor advisory has been provided yet.

Successful exploitation of this vulnerability can lead to remote code execution on the affected device without requiring authentication or user interaction. This could allow attackers to take control of the device, potentially leading to network compromise or disruption of services. The high CVSS score reflects the critical nature of the impact, but there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting network exposure of the affected device, such as restricting access to the management interface and monitoring for suspicious activity related to the /goform/addressNat endpoint. Avoid using version 1.0.0.7 of the Tenda F451 firmware if possible.