A critical stack-based buffer overflow in the Tenda F453 router allows remote attackers to achieve code execution or denial of service.

The vulnerability exists in the formWrlExtraSet function within the /goform/WrlExtraSet endpoint, where the GO argument is processed without sufficient length validation. This lack of bounds checking allows an authenticated attacker to trigger a stack-based buffer overflow, potentially leading to remote code execution.

The exploitation of this vulnerability poses a severe risk to network integrity, as a successful attack on the router can grant the adversary full control over the device. This compromise could facilitate unauthorized access to local network traffic, facilitate man-in-the-middle attacks, or result in total system downtime. With a CVSS score of 8.8, this flaw represents a high-severity threat that necessitates immediate attention to prevent device takeover.

Immediate Action: Contact Tenda support or monitor the official Tenda website for firmware updates addressing this vulnerability, as no patch is currently confirmed for version 1.0.0.3.

Proactive Monitoring: Review device access logs for unusual POST requests directed at /goform/WrlExtraSet, particularly those containing excessively long string parameters in the GO field.

Compensating Controls: Restrict administrative access to the router interface to trusted internal IP addresses only, and disable remote management features to reduce the attack surface.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the technical write-up by Li Tengzheng.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to affected Tenda F453 deployments. Administrators should prioritize isolating vulnerable devices from the public internet until a vendor-supplied firmware update is verified and applied.