A critical stack-based buffer overflow vulnerability in Tenda WH450 routers poses a severe risk of remote code execution by unauthenticated attackers.

The vulnerability is a stack-based buffer overflow (CWE-121) located in the HTTP request handler for the /goform/L7Im endpoint. An unauthenticated attacker can trigger this flaw by sending a crafted HTTP request with an excessively long string in the page parameter.

The ability for an unauthenticated remote attacker to achieve arbitrary code execution on networking infrastructure is a severe security failure. This vulnerability could lead to total compromise of the affected device, potentially allowing an attacker to intercept network traffic, pivot into internal network segments, or render the device unusable, causing significant operational downtime. Given the CVSS score of 9.8, this flaw represents a critical threat to organizational security.

Immediate Action: As no specific patch version is currently available, users should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet. If possible, isolate the affected hardware within a restricted management VLAN.

Proactive Monitoring: Security teams should monitor firewall and web access logs for anomalous GET requests directed at the /goform/L7Im endpoint, particularly those containing unusually long string parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures capable of detecting and blocking malformed HTTP requests that target buffer overflow vulnerabilities in embedded web servers.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical write-up on GitHub.

Due to the critical nature of this vulnerability and the availability of public exploit code, immediate mitigation is required. Administrators should treat the affected devices as compromised if they have been exposed to the public internet. Organizations must prioritize the implementation of network-level access controls until the vendor releases a firmware update that addresses the memory corruption issue.