A critical stack-based buffer overflow vulnerability in Tenda F451 allows remote attackers to achieve unauthorized control over the device, posing a significant risk of compromise.

This vulnerability is a stack-based buffer overflow (CWE-121) within the WrlclientSet function of the httpd component. An attacker with low-level privileges can send a crafted request to the /goform/WrlclientSet endpoint to trigger memory corruption.

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system impact. Successful exploitation allows an attacker to execute arbitrary code or cause a denial of service, potentially leading to unauthorized network access, data exfiltration, or complete loss of control over the networking hardware.

Immediate Action: Since a specific patch is currently unknown, restrict access to the device management interface to trusted internal networks only. Contact Tenda support or monitor their official website for firmware updates addressing this buffer overflow.

Proactive Monitoring: Review device access logs for unusual traffic patterns directed at the /goform/WrlclientSet endpoint. Monitor system stability for unexpected reboots or service crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to inspect and block malicious payloads targeting the specific vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research findings documented at https://github.com/Jimi-Lab/cve/issues/12.

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability should be treated with urgency. Administrators must prioritize isolating the affected Tenda F451 units from public-facing internet access until a vendor-supplied firmware patch is verified and applied.