A critical stack-based buffer overflow vulnerability in Tenda F456 firmware, version 1.0.0.5, poses a severe risk of remote code execution or denial of service.

The vulnerability exists in the fromSafeClientFilter function within the /goform/SafeClientFilter endpoint. An authenticated attacker can supply an overly long string to the menufacturer parameter, which is then concatenated without bounds checking, leading to a stack-based buffer overflow.

The potential for remote code execution represents a significant security risk, as it grants unauthorized actors control over network infrastructure. Given the CVSS score of 8.8, this vulnerability is classified as high severity, potentially leading to full system compromise, lateral movement within the network, or persistent denial of service. Such an event would severely impact business continuity and compromise the integrity of the local network environment.

Immediate Action: Since no official patch is currently available, administrators must restrict access to the device management interface and disable remote administration features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/SafeClientFilter endpoint, particularly those containing unusually large payloads in the menufacturer parameter.

Compensating Controls: Implement strict firewall rules to ensure the device management interface is only accessible from trusted internal management subnets rather than the public internet.

Public Exploit Available: Yes, a functional proof-of-concept has been published in the researcher's technical write-up.

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Because Tenda has not yet released a patch, organizations utilizing the F456 router must prioritize network-level isolation of the device. Administrators should monitor for vendor firmware updates daily and apply them immediately upon release to mitigate the risk of remote exploitation.