This vulnerability affects Tenda F456 firmware version 1.0.0.5. The issue lies in the fromGstDhcpSetSer function within the httpd service, where improper handling of the 'dips' argument leads to a buffer overflow condition. This can be triggered remotely over the network without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation. No official fix or mitigation has been documented at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the remote network attack vector with no required privileges or user interaction, the risk to exposed devices is significant. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider limiting network exposure of the device, such as restricting access to the management interface and monitoring for unusual activity. Avoid using version 1.0.0.5 of Tenda F456 where possible.