A critical stack-based buffer overflow vulnerability in the Tenda FH451 router allows remote attackers to execute arbitrary code or cause a denial of service.

The vulnerability exists in the /goform/WrlExtraSet endpoint, where the application fails to perform adequate length validation on the user-provided GO parameter before copying it into a stack-based buffer. This flaw is reachable by authenticated users, who can leverage the overflow to achieve remote code execution or crash the device firmware.

Successful exploitation of this vulnerability poses a severe risk to network integrity and confidentiality. By achieving remote code execution, an attacker could gain full control over the router, intercepting sensitive traffic, modifying DNS settings, or pivoting into the internal network. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security, particularly for environments where these routers are used as edge gateways.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface, ensuring it is not exposed to the internet.

Proactive Monitoring: Review device logs for unusual POST requests directed at the /goform/WrlExtraSet endpoint and monitor for unexpected device reboots, which may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long payloads sent to the GO parameter within the /goform/WrlExtraSet path.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

The presence of a publicly available proof-of-concept significantly increases the risk of this vulnerability being weaponized. Organizations using the Tenda FH451 should prioritize isolating these devices from external access immediately. Until the vendor provides a firmware update to resolve the buffer overflow, these compensating controls are essential to prevent unauthorized access and potential system compromise.