This vulnerability involves a buffer overflow in the fromSafeUrlFilter function of the Tenda F456 router firmware version 1.0.0.5. The flaw is triggered by manipulating the 'page' argument in the /goform/SafeUrlFilter HTTP endpoint, which leads to memory corruption. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 8.7, indicating high severity. The weakness is categorized under CWE-120 and CWE-119, which relate to classic buffer overflow issues. Although exploit code is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability could allow a remote attacker with low privileges to cause a buffer overflow, potentially leading to denial of service or arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability is remotely exploitable without user interaction, increasing its risk. However, no confirmed active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface and monitoring for suspicious activity. Avoid exposing the device's HTTP management interface to untrusted networks. Follow vendor channels for updates regarding patches or official mitigations.