The Tenda F451 router firmware version 1.0.0.7_cn_svn7958 contains a stack-based buffer overflow vulnerability in the fromSafeUrlFilter function of the /goform/SafeUrlFilter endpoint. Manipulating the 'page' argument allows an attacker to overflow the stack buffer remotely, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No vendor patch or official remediation has been documented.

Successful exploitation of this vulnerability can allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda F451 device. The vulnerability impacts confidentiality, integrity, and availability of the device. Given the remote attack vector and lack of required privileges or user interaction, the risk is significant. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the affected device and monitor for any unusual activity. Avoid exposing the management interface to untrusted networks. Follow vendor channels for updates regarding patches or official mitigations.