This vulnerability in Tenda F456 1.0.0.5 involves a stack-based buffer overflow triggered by improper handling of the cmdinput argument in the fromexeCommand function located in /goform/exeCommand. The flaw allows a remote attacker to execute code or cause a denial of service by sending crafted input to the affected endpoint. The CVSS 4.0 score of 8.7 reflects high impact and exploitability, with no privileges or user interaction required. No official fix or mitigation has been documented, and the device is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation can lead to remote code execution or denial of service on the affected Tenda F456 device. The vulnerability requires no user interaction and low privileges, making it a significant risk. The exploit is publicly available, increasing the likelihood of attacks. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the affected device and monitor for suspicious activity targeting the /goform/exeCommand endpoint. Avoid exposing the device to untrusted networks. Follow vendor communications for updates on patches or official mitigations.