This vulnerability involves a buffer overflow in the frmL7ImForm function of the Tenda F456 firmware version 1.0.0.5. Specifically, improper handling of the 'page' argument in the /goform/L7Im endpoint allows an attacker to overflow a buffer remotely. The CVSS 4.0 score of 8.7 reflects high impact due to network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was published on May 24, 2026, and while the exploit code is publicly available, no active exploitation has been reported. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation could allow a remote attacker to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The vulnerability impacts confidentiality, integrity, and availability of the device. Given the remote attack vector and lack of required privileges or user interaction, the risk is significant for affected devices running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected device's management interfaces to trusted sources only. Monitor vendor communications for updates on patches or official mitigations.