This vulnerability involves a stack-based buffer overflow triggered by improper handling of the qos argument in the fromqossetting function within the /goform/qossetting endpoint of Tenda F451 firmware version 1.0.0.7_cn_svn7958. The flaw allows remote attackers to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation. Although an exploit is publicly available, there is currently no official fix or patch released by the vendor.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected Tenda F451 devices. The vulnerability requires no user interaction and can be triggered remotely, increasing the risk of compromise. The public availability of an exploit further elevates the threat level. However, no known active exploitation in the wild has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device's management interface and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently documented.