Description
A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Published: 2026-06-08
Score: 8.7 High
EPSS: 1.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the formWriteFacMac function of the Tenda F451 Web Management Interface allows a crafted mac parameter to inject and execute arbitrary OS commands. This can enable an attacker to run commands on the router, posing a serious threat to the device’s integrity, availability, and potentially the internal network it serves. The issue is classified as CWE‑77 and CWE‑78, reflecting unsafe command construction and execution.

Affected Systems

The vulnerability affects Tenda F451 routers running firmware versions 1.0.0.7 and 1.0.0.9. It resides in the Web Management Interface component exposed via the /goform/WriteFacMac endpoint.

Risk and Exploitability

The EPSS score of 2% indicates a low probability of exploitation. The CVSS score of 8.7 signals high severity. Since the exploit is publicly available and the vulnerable endpoint can be reached remotely, an attacker who succeeds can run arbitrary OS commands, compromising device integrity. While the overall exploitation likelihood is low based on EPSS, the potentially severe impact justifies immediate remediation.

Generated by OpenCVE AI on June 18, 2026 at 07:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to a version that addresses the formWriteFacMac injection flaw, if an update is available from Tenda.
  • If no firmware update is available, disable the Web Management Interface or restrict its access to trusted internal networks only, blocking external exposure with firewall rules.
  • Consider segmenting or isolating the router’s management network to limit exposure to potential attackers, and monitor management interface logs for suspicious activity.

Generated by OpenCVE AI on June 18, 2026 at 07:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda f451
Vendors & Products Tenda f451

Mon, 08 Jun 2026 18:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Title Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
First Time appeared Tenda
Tenda f451 Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F451 F451 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-09T14:35:15.927Z

Reserved: 2026-06-08T05:55:33.297Z

Link: CVE-2026-11556

cve-icon Vulnrichment

Updated: 2026-06-09T14:33:19.739Z

cve-icon NVD

Status : Deferred

Published: 2026-06-08T18:16:33.040

Modified: 2026-06-09T01:32:36.950

Link: CVE-2026-11556

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T07:30:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')