A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 may allow remote attackers to achieve remote code execution or cause a system crash.

This vulnerability is a stack-based buffer overflow (CWE-120) triggered within the frmL7ProtForm function of the httpd service. An attacker with low-level access can send a crafted POST request to the /goform/L7Prot endpoint containing an overly long page parameter to corrupt memory.

The exploitation of this vulnerability poses a severe risk to network integrity and availability. Successful execution allows for unauthorized remote code execution, which could lead to full device compromise, data exfiltration, or the establishment of a persistent foothold in the local network. With a CVSS score of 8.8, this flaw represents a High severity risk that could result in significant operational downtime or the total loss of confidentiality and integrity for the affected device.

Immediate Action: As no official patch version is currently identified, users should restrict network access to the management interface of the Tenda F456 device. Ensure the device is not exposed to the public internet and limit access to trusted administrative subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/L7Prot endpoint. Additionally, watch for unexpected device reboots or service instability, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming HTTP requests that contain excessively long strings within the page parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up provided by the vulnerability reporter.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating the affected hardware from untrusted networks and contact the vendor for information regarding a firmware update. Until a formal patch is released, the device should be considered high-risk and monitored closely for any signs of compromise.