This vulnerability affects Tenda F456 firmware version 1.0.0.5 and involves a buffer overflow triggered by specially crafted input to the /goform/setcfm HTTP endpoint. The vulnerable parameters are funcname and funcpara1, which when manipulated can overflow a buffer in the httpd component. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 8.7, indicating high severity. No vendor advisory or patch information is currently available, and the device is not a cloud service.

Successful exploitation of this buffer overflow may allow remote attackers to cause a denial of service or potentially execute arbitrary code on the affected device. Given the high CVSS score and remote attack vector, the impact could be significant for devices running the vulnerable firmware. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.