This vulnerability affects Tenda F456 firmware version 1.0.0.5. The fromSetIpBind function in the /goform/SetIpBind endpoint of the embedded httpd server improperly handles the 'page' argument, resulting in a buffer overflow condition. The vulnerability is remotely exploitable without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation. No official patch or mitigation details have been disclosed by Tenda as of the publication date.

Successful exploitation of this buffer overflow could allow remote attackers to execute arbitrary code or cause a denial of service on affected Tenda F456 devices running firmware 1.0.0.5. The vulnerability does not require user interaction or elevated privileges, increasing its risk. Although an exploit is publicly available, there are no confirmed reports of active exploitation in the wild. The impact is rated high due to the potential for remote code execution and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by Tenda, users should monitor vendor communications for updates. Until a patch is available, limiting network exposure of the affected device and restricting access to the /goform/SetIpBind endpoint may reduce risk.