A critical stack-based buffer overflow vulnerability in the Tenda F451 router allows remote, authenticated attackers to execute arbitrary code or crash the system.

This is a stack-based buffer overflow (CWE-121) occurring within the fromAdvSetWan function of the /goform/AdvSetWan endpoint. The vulnerability is triggered by sending malicious input to the wanmode or PPPOEPassword arguments, requiring at least low-level authenticated access to the device.

The vulnerability carries a CVSS score of 8.8, indicating a high potential for severe impact on organizational infrastructure. Successful exploitation allows for remote code execution, which could lead to full device compromise, loss of network control, and lateral movement into the internal network environment.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for unusual payloads directed at the /goform/AdvSetWan endpoint and review system logs for recurring service crashes or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion detection system to filter or block requests containing excessively long strings in the wanmode or PPPOEPassword fields.

Public Exploit Available: Yes, a published proof-of-concept exists via the Jimi-Lab/cve repository.

Given the high severity of this memory corruption vulnerability and the availability of a public proof-of-concept, immediate defensive action is required. Organizations using the Tenda F451 should prioritize isolating the management interface from the public internet and await official remediation from the vendor.