A stack-based buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a critical risk of remote code execution for authenticated users.

The vulnerability exists within the fromPptpUserAdd function of the httpd component. By sending a crafted POST request to the /goform/PPTPDClient endpoint with an overly long username parameter while opttype is set to 1, an authenticated attacker can trigger a stack-based buffer overflow.

The potential for remote code execution (RCE) allows an attacker to gain full control over the affected network device. This level of compromise can lead to complete network traffic interception, unauthorized access to internal resources, and significant system instability. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could severely impact the security and integrity of the local network environment.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the device management interface to trusted IP addresses only and disable unnecessary services like PPTP if not required.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/PPTPDClient endpoint, specifically looking for unusually large payloads in the username field.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to inspect and block excessively long input strings sent to router administrative endpoints.

Public Exploit Available: Yes, a functional Proof of Concept (PoC) is publicly available via a researcher write-up hosted on GitHub.

Due to the critical nature of this memory corruption vulnerability and the availability of a public exploit, immediate defensive measures are required. Organizations should prioritize isolating affected Tenda F456 units from untrusted networks and monitor for vendor-provided firmware updates to address the underlying code defect.