A critical stack-based buffer overflow vulnerability in the Tenda FH451 router enables remote attackers to achieve denial of service or arbitrary code execution.

The vulnerability exists in the fromSetCfm function within the /goform/setcfm endpoint, where improper validation of the funcname and funcpara1 parameters leads to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements (PR:L), the flaw allows for remote memory corruption via HTTP POST requests.

The ability for an unauthenticated or low-privileged remote attacker to execute arbitrary code on networking hardware poses a severe risk to organizational infrastructure. Successful exploitation could lead to total compromise of the device, enabling traffic interception, lateral movement into internal networks, or persistent denial of service. Given the high CVSS score of 8.8, immediate remediation is required to prevent unauthorized access to sensitive network traffic.

Immediate Action: Contact Tenda support to verify if a firmware patch exists for the 1.0.0.9 version, as no public fix is currently confirmed. If no patch is available, restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/setcfm endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Implement a Web Application Firewall (WAF) or intrusion detection rule to filter and block oversized inputs sent to the /goform/setcfm administrative interface.

Public Exploit Available: Yes, a functional Proof of Concept (PoC) exists as documented in the technical write-up provided by the researcher on GitHub.

The severity of this vulnerability necessitates a proactive posture. Administrators should immediately isolate affected devices from external network exposure and monitor for any suspicious activity targeting administrative endpoints. In the absence of an official vendor patch, restricting management access to authorized users is the most effective temporary measure to mitigate the risk of remote code execution.