This vulnerability involves a buffer overflow in Tenda F456 firmware version 1.0.0.5, specifically in an unknown function handling requests to /goform/setcfm in the httpd service. The flaw is caused by improper handling of the funcname and funcpara1 parameters, which can be manipulated remotely without authentication to overflow a buffer. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is categorized under CWE-120 and CWE-119, which relate to classic buffer overflow issues. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow a remote attacker to cause a buffer overflow on the device, potentially leading to denial of service or arbitrary code execution depending on the device's handling of the overflow. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, especially restricting access to the /goform/setcfm endpoint. Monitor vendor communications for updates on patches or official mitigations.