This vulnerability exists in Tenda F451 version 1.0.0.7 within the fromSafeMacFilter function of the /goform/SafeMacFilter endpoint handled by the httpd component. A specially crafted request manipulating the page/menufacturer argument can cause a stack-based buffer overflow, which may lead to remote code execution or service disruption. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 base score is 8.7, indicating high severity. No official fix or patch has been disclosed by Tenda as of the publication date.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected device or cause it to crash, resulting in denial of service. Given the remote attack vector and lack of required user interaction, the impact on device confidentiality, integrity, and availability is high. There are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor communications for updates on patches or mitigations.