A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, permits remote code execution, posing a severe risk to network integrity.

This is a stack-based buffer overflow (CWE-120) triggered by the SafeEmailFilter function within the /goform/SafeEmailFilter endpoint. An authenticated attacker can exploit this by sending a specially crafted page parameter to the HTTP interface, which lacks sufficient length validation during memory operations.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for full system compromise. Successful exploitation allows an attacker to execute arbitrary code or force a denial of service, potentially leading to unauthorized access to internal network traffic, loss of router control, and significant operational disruption.

Immediate Action: Since a specific patch is not currently available, administrators should restrict management access to the router to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/SafeEmailFilter endpoint. Any signs of service instability or unexpected reboots should be investigated as potential exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or similar network security appliance to inspect inbound HTTP traffic for unusually long parameter strings in requests destined for the router management interface.

Public Exploit Available: Yes, a proof-of-concept is available via a published researcher write-up at the referenced GitHub repository.

Given the high severity and the existence of a public proof-of-concept, users of the Tenda F456 should treat this vulnerability with extreme urgency. Until a vendor-supplied firmware update is released, prioritize isolating the management interface from all untrusted networks to prevent unauthorized access and exploitation.