This vulnerability involves a buffer overflow in the fromVirtualSer function of the /goform/VirtualSer endpoint in Tenda F456 firmware version 1.0.0.5. The flaw is triggered by manipulating the menufacturer/Go argument, leading to memory corruption. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. It has a CVSS 4.0 base score of 8.7, indicating high severity due to potential high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation of this buffer overflow can lead to memory corruption, potentially allowing an attacker to execute arbitrary code remotely. The vulnerability impacts confidentiality, integrity, and availability of the affected device. Given the high CVSS score and remote attack vector, it poses a significant risk to affected Tenda F456 devices running version 1.0.0.5. However, no confirmed exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.