This vulnerability affects Tenda F453 routers running firmware versions 1.0.0.0 through 1.0.0.3. It is a command injection flaw in the Telnet Service's TendaTelnet function, specifically in the /goform/telnet endpoint. An attacker can remotely manipulate input to inject and execute arbitrary commands on the device. The vulnerability is publicly disclosed, increasing the risk of exploitation, although no active exploitation has been confirmed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected Tenda F453 device, potentially compromising device integrity and control. The impact is rated medium, reflecting limited but significant risk due to remote command execution capability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided information. Users should monitor Tenda's official channels for firmware updates addressing this vulnerability. Until a patch is available, disabling the Telnet service, if possible, may reduce exposure.