A critical buffer overflow vulnerability in Tenda FH451 routers allows remote attackers to achieve unauthorized memory corruption and potentially system compromise.

This flaw is a buffer overflow (CWE-120) triggered by improper processing of data within the /goform/GstDhcpSetSer file. An attacker with low privileges can initiate this attack remotely to corrupt system memory.

Successful exploitation of this vulnerability can lead to a complete compromise of the affected router, resulting in unauthorized network access, potential traffic interception, or permanent denial of service. With a CVSS score of 8.8, this high-severity flaw represents a significant risk to network integrity and confidentiality, particularly for small office or home office environments relying on the device for perimeter security.

Immediate Action: Since no official vendor patch is currently identified, isolate the affected Tenda FH451 device from the public-facing internet immediately. Disable administrative access from WAN interfaces to prevent remote exploitation.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/GstDhcpSetSer endpoint. Review device logs for crash events or unexpected reboots that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to drop traffic containing malformed inputs directed at the identified vulnerable URI.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up at the referenced source.

Given the availability of a public proof-of-concept and the potential for remote system compromise, this vulnerability poses a severe threat to network security. Administrators must prioritize restricting access to the management interface and monitor for vendor-released firmware updates. If the device cannot be updated or properly segmented, consider replacing it with a supported alternative to ensure ongoing security.