A stack-based buffer overflow in Tenda WH450 firmware version 1.0.0.18 poses a critical risk of remote code execution or denial of service.

The vulnerability is a stack-based buffer overflow located in the HTTP request handler for the /goform/VirtualSer endpoint. Although the CVSS vector indicates that high privileges are required, the researcher-provided proof-of-concept demonstrates that the flaw is reachable via the HTTP interface, potentially allowing an attacker to overwrite memory and execute arbitrary code.

Successful exploitation of this buffer overflow can lead to complete system compromise, including the execution of arbitrary code with high privileges or persistent denial of service. Given the CVSS score of 7.2, this represents a high-severity risk that could facilitate unauthorized network access or disruption of critical communications handled by the router.

Immediate Action: Contact Tenda support or check the official Tenda website for firmware updates addressing this buffer overflow, as no public patch is currently confirmed.

Proactive Monitoring: Monitor network traffic for suspicious HTTP requests targeting the /goform/VirtualSer endpoint, particularly those containing abnormally long strings in the page parameter.

Compensating Controls: Implement strict access control lists on the router management interface to restrict access to trusted administrative IP addresses, effectively mitigating remote exploitation attempts.

Public Exploit Available: Yes, a functional proof-of-concept script has been published in the researcher's technical write-up on GitHub.

Due to the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability should be treated with high urgency. Administrators must restrict access to the management interface immediately and verify with the vendor whether a firmware update is available to remediate the underlying memory corruption flaw.