A critical buffer overflow vulnerability in Tenda F451 allows for remote memory corruption and potential system compromise.

This is a memory corruption flaw (CWE-120) triggered by improper input validation in the fromSafeClientFilter function within the /goform/SafeClientFilter endpoint. The vulnerability can be triggered by a remote attacker with low-level privileges by sending a crafted request to the menufacturer/Go argument.

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system impact. Successful exploitation could lead to unauthorized code execution or service disruption, potentially exposing internal network segments or causing significant downtime for critical infrastructure relying on this hardware.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the device management interface to trusted IPs only and disable remote access features.

Proactive Monitoring: Monitor device traffic and system logs for unexpected behavior or repeated access attempts targeting the /goform/SafeClientFilter endpoint.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system to filter out requests containing malicious payloads in the menufacturer/Go parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on the Jimi-Lab GitHub repository.

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability poses a significant risk to affected Tenda F451 devices. Administrators must implement network-level access controls immediately to prevent remote exploitation, as a vendor patch is not currently available. Continued monitoring for firmware updates from Tenda is essential to address this memory corruption vulnerability at the root level.