A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a severe risk of remote code execution for authenticated users.

This is a stack-based buffer overflow occurring in the fromSafeMacFilter function within the /goform/SafeMacFilter endpoint. The vulnerability is triggered by sending a specially crafted, oversized value to the page parameter, which allows an attacker with low privileges to achieve remote code execution or trigger a denial of service.

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. This facilitates unauthorized access to local network traffic, potential interception of sensitive data, or complete disruption of internet connectivity, leading to significant operational downtime. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security integrity.

Immediate Action: As no vendor patch is currently confirmed, administrators should immediately restrict access to the web management interface of affected devices to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for abnormal POST requests directed at the /goform/SafeMacFilter endpoint, particularly those containing excessively long string parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control lists to block or sanitize traffic directed at the router's management web interface.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's GitHub write-up.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Organizations utilizing Tenda F456 hardware should prioritize isolating these devices from external network exposure until an official firmware update is released and verified. Failure to mitigate this risk leaves critical network infrastructure vulnerable to compromise by remote actors.