This vulnerability affects Tenda F456 firmware version 1.0.0.5. The issue lies in the formWrlsafeset function within the /goform/AdvSetWrlsafeset endpoint. By sending a specially crafted argument to mit_ssid, an attacker can cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or vendor advisory has been published yet, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the stack-based buffer overflow nature, it may lead to system compromise or disruption of network services provided by the Tenda F456 device. The vulnerability requires no user interaction and can be triggered remotely, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to management interfaces. Monitor vendor communications for updates on patches or mitigations.