The Tenda F453 router is susceptible to a critical buffer overflow vulnerability that could allow an authenticated attacker to execute arbitrary code or crash the device.

This is a stack-based buffer overflow occurring in the fromDhcpListClient function within the httpd component. The vulnerability is triggered by an authenticated attacker who sends a crafted request to the /goform/DhcpListClient endpoint, passing an excessively long string to the page argument without proper length validation.

The exploitation of this vulnerability poses a severe risk to network integrity and availability. A successful attack can lead to complete system compromise, allowing unauthorized code execution, or result in persistent service disruption, which may impact business operations relying on the affected network infrastructure. With a CVSS score of 8.8, this vulnerability is classified as High severity and warrants immediate attention from network administrators.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management interface of the Tenda F453 to trusted IP addresses only.

Proactive Monitoring: Review device system logs for abnormal crashes or repeated service restarts, and monitor network traffic for suspicious POST requests directed at the /goform/DhcpListClient endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing oversized payloads targeting the vulnerable DhcpListClient form.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the technical write-up provided by the researcher on GitHub.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant security risk. Administrators should isolate vulnerable devices from public-facing networks until a firmware update is provided by Tenda. Organizations must prioritize monitoring and access restriction to mitigate the risk of exploitation until official remediation is released.