This vulnerability in Tenda F456 1.0.0.5 involves a stack-based buffer overflow triggered by specially crafted input to the cmdinput argument of the fromexeCommand function located in /goform/exeCommand. The flaw allows remote attackers to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been documented yet.

Successful exploitation could allow remote attackers to execute arbitrary code or disrupt device operation due to the stack-based buffer overflow. The vulnerability impacts confidentiality, integrity, and availability of the affected device. No known exploits in the wild have been reported so far, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device and monitor for suspicious activity targeting the /goform/exeCommand endpoint. Avoid exposing the device directly to untrusted networks.