This vulnerability involves a buffer overflow triggered by manipulation of the wanmode argument in the fromAdvSetWan function of the /goform/AdvSetWan endpoint in Tenda F456 firmware version 1.0.0.5. The flaw resides in the httpd component, allowing remote attackers to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation without privileges or user interaction. No official patch or vendor advisory has been published yet.

Successful exploitation can lead to remote code execution or denial of service on affected Tenda F456 devices running version 1.0.0.5. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk to exposed devices. Public exploit code availability raises the likelihood of attacks, although no in-the-wild exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider restricting network access to the vulnerable device's management interface to trusted sources only and monitor for unusual activity. Avoid exposing the device's management interface to untrusted networks.