This vulnerability in Tenda F456 1.0.0.5 involves a buffer overflow in the fromPptpUserAdd function within the /goform/PPTPDClient HTTP server component. Remote attackers can manipulate the opttype/username argument to trigger the overflow. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is categorized under CWE-120 and CWE-119, which relate to classic buffer overflow issues. Public exploit code is available, but no vendor patch or official remediation level has been documented.

Successful exploitation can lead to a buffer overflow condition on the Tenda F456 device, potentially allowing remote code execution or denial of service. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk. The public availability of exploit code further elevates the threat. However, no confirmed reports of exploitation in the wild are noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface to trusted sources only. Monitor vendor channels for updates and apply patches promptly once available.