This vulnerability affects Tenda F456 version 1.0.0.5 and is located in the fromWrlclientSet function of the /goform/WrlclientSet endpoint in the httpd component. The issue is a buffer overflow caused by improper handling of input data, which can be triggered remotely without user interaction or privileges. The CVSS 4.0 base score is 8.7, indicating high severity due to network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, increasing the risk of exploitation. No official patch or vendor advisory is currently available.

Successful exploitation of this buffer overflow vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service on affected Tenda F456 devices running firmware version 1.0.0.5. This compromises the confidentiality, integrity, and availability of the device. The exploit is publicly known, which raises the risk of attacks, although no active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to the management interface. Monitor vendor channels for updates and apply any official patches promptly once available.