This vulnerability in Tenda F456 1.0.0.5 involves a buffer overflow in the fromVirtualSer function of the /goform/VirtualSer endpoint within the httpd component. The issue is triggered by manipulating the menufacturer/Go argument remotely, leading to memory corruption. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the published date.

Successful exploitation can lead to remote code execution or denial of service due to buffer overflow, compromising the affected device's confidentiality, integrity, and availability. Since the attack can be performed remotely without authentication or user interaction, the risk to exposed devices is significant. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the /goform/VirtualSer endpoint or isolating the device from untrusted networks. Monitor vendor channels for updates and apply patches promptly once available.