This vulnerability affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. The fromqossetting function in the /goform/qossetting endpoint improperly processes the qos argument, resulting in a stack-based buffer overflow. The vulnerability is remotely exploitable without authentication or user interaction, making it a critical risk for affected devices. The CVSS 4.0 base score is 8.7, reflecting high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the exploit code has been publicly released.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected Tenda F451 devices. The attacker can manipulate the qos argument remotely to trigger a stack-based buffer overflow, potentially compromising device confidentiality, integrity, and availability. Given the high CVSS score and public exploit availability, affected devices are at significant risk until remediation is applied.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management features if possible or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.