This vulnerability affects Tenda F456 version 1.0.0.5 and involves a buffer overflow in the formWrlExtraSet function of the /goform/WrlExtraSet endpoint in the httpd component. Remote attackers can exploit this by sending crafted input to the 'Go' argument, potentially leading to memory corruption. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 8.7, indicating high severity. No official fix or mitigation has been documented by the vendor at this time.

Successful exploitation of this vulnerability could allow remote attackers to cause a buffer overflow, which may lead to denial of service or potentially arbitrary code execution on the affected device. Given the high CVSS score and remote attack vector, this poses a significant risk to the confidentiality, integrity, and availability of the device and its network environment. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor channels for updates and apply patches promptly once available.