A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a high risk of remote code execution.

The vulnerability exists in the formWrlExtraSet function of the httpd service. An attacker with low privileges can trigger a stack-based buffer overflow by sending a crafted request containing a long string to the Go parameter via the /goform/WrlExtraSet endpoint, potentially leading to remote code execution.

Successful exploitation of this flaw allows an attacker to achieve remote code execution, granting them control over the affected network device. Given the high CVSS score of 8.8, this vulnerability could be leveraged to intercept network traffic, pivot into internal segments, or render the device unresponsive, significantly impacting business operations and network security.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the management interface by isolating the device from the public internet and ensuring it is only accessible via a secure, internal management VLAN.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlExtraSet endpoint and review system logs for signs of unexpected service restarts or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to detect and block oversized inputs sent to the Go parameter on the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up by Li Tengzheng.

The severity of this vulnerability necessitates immediate attention, as the availability of a public proof-of-concept significantly lowers the barrier for exploitation. Organizations should prioritize isolating the affected Tenda F456 devices from external networks and monitor vendor channels for the release of a security update. Failing to restrict access to this device may expose the internal network to unauthorized command execution.