This vulnerability involves a buffer overflow in the formWrlExtraSet function of the Tenda F456 router firmware version 1.0.0.5. The flaw is triggered by remote manipulation of the Go argument in the /goform/WrlExtraSet HTTP endpoint. The vulnerability allows an attacker to cause a buffer overflow remotely without user interaction or privileges. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed with an exploit published, but no official patch or remediation level has been announced by the vendor.

Successful exploitation of this vulnerability can lead to a buffer overflow condition on the affected device, which may allow remote attackers to execute arbitrary code or cause a denial of service. Given the high CVSS score and remote attack vector, the impact on affected devices is significant. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by Tenda, users should monitor vendor communications closely. Until a patch is available, consider restricting network access to the affected device's management interface to trusted sources only to reduce exposure.