This vulnerability affects Tenda F456 version 1.0.0.5 and involves a buffer overflow in the fromwebExcptypemanFilter function within the /goform/webExcptypemanFilter endpoint of the httpd component. An attacker can remotely manipulate the 'page' argument to trigger the overflow. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with an available exploit, but no vendor patch or official remediation level has been documented.

Successful exploitation of this buffer overflow could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The vulnerability impacts confidentiality, integrity, and availability of the Tenda F456 router. Given the high CVSS score and remote attack vector, this poses a significant risk to affected systems if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote management access. Monitor vendor channels for updates and apply patches promptly once available.