The Tenda F456 router firmware version 1.0.0.5 contains a stack-based buffer overflow vulnerability in the fromqossetting function of the /goform/qossetting endpoint. This vulnerability arises from improper handling of the 'page' argument, allowing an attacker to overflow the stack buffer remotely. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code has been made public, increasing the risk of potential attacks. No official patch or mitigation has been documented by the vendor at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected device due to the stack-based buffer overflow. This could lead to device compromise, potentially affecting the confidentiality, integrity, and availability of the router and the network it serves. Given the high CVSS score and public availability of exploit code, the risk to affected devices is significant. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to the management interface. Monitor vendor communications for updates on patches or official mitigations. No vendor advisory or official fix information is currently available.