This vulnerability involves a buffer overflow in the fromAdvSetWan function of the Tenda F456 router firmware version 1.0.0.5. The flaw is triggered by specially crafted input to the wanmode parameter in the /goform/AdvSetWan HTTP endpoint, which is part of the router's httpd component. The overflow can be exploited remotely without user interaction or privileges. The CVSS 4.0 score is 8.7, reflecting high impact and ease of exploitation. Public exploit code is available, but no official patch or vendor remediation has been published as of the current data.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, potentially allowing remote attackers to execute arbitrary code or cause denial of service on affected devices. The vulnerability requires no user interaction and can be triggered remotely, increasing its risk. However, no known exploits in the wild have been reported yet. The impact is limited to devices running Tenda F456 firmware version 1.0.0.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected device to untrusted networks and monitor vendor communications for updates. No vendor advisory or official patch link is currently available.