This vulnerability involves a buffer overflow in the Tenda F456 router firmware version 1.0.0.5. Specifically, the frmL7ImForm function in the /goform/L7Im endpoint improperly handles the 'page' argument, allowing an attacker to remotely cause a buffer overflow. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on May 24, 2026, but no official patch or mitigation has been announced by Tenda.

Successful exploitation of this vulnerability could allow a remote attacker to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided by Tenda, users should monitor vendor communications for updates. Until a patch is available, restricting remote access to the affected device and limiting exposure of the /goform/L7Im endpoint may reduce risk.