Description
A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution potential
Action: Immediate Patch
AI Analysis

Impact

An attacker can remotely manipulate the GO parameter within the WrlclientSet function of the /goform/WrlclientSet endpoint. This triggers a stack-based buffer overflow that could allow arbitrary code execution or denial of service on the Tenda FH451 device. The vulnerability is classified as CWE‑119 and CWE‑121, indicating unsafe buffer operations that lead to stack corruption.

Affected Systems

Affected devices are Tenda FH451 routers running firmware 1.0.0.9. No other versions are explicitly mentioned.

Risk and Exploitability

The CVSS v3.1 score is 8.7, indicating a high severity level. The EPSS score is below 1 %, suggesting a relatively low probability of exploitation, yet a publicly disclosed exploit exists and could be used by attackers. The attack vector is remote and likely originates from a connected network or over the wireless interface. No known listing in the CISA KEV catalog.

Generated by OpenCVE AI on April 3, 2026 at 20:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the current firmware version on the Tenda FH451 router.
  • Check for an updated firmware release that patches the WrlclientSet stack overflow.
  • If an update is available, apply the firmware upgrade following Tenda’s instructions.
  • If no patch is available, disable remote management or block access to the /goform/WrlclientSet endpoint via firewall rules.
  • Continuously monitor network traffic for unusual patterns related to the WrlclientSet function.

Generated by OpenCVE AI on April 3, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:fh451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:fh451_firmware:1.0.0.9:*:*:*:*:*:*:*

Tue, 24 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda fh451
Vendors & Products Tenda fh451

Sun, 22 Mar 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title Tenda FH451 WrlclientSet stack-based overflow
First Time appeared Tenda
Tenda fh451 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:fh451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda fh451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Fh451 Fh451 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-24T14:30:09.933Z

Reserved: 2026-03-21T08:05:15.158Z

Link: CVE-2026-4535

cve-icon Vulnrichment

Updated: 2026-03-24T14:30:06.589Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-22T05:16:19.640

Modified: 2026-04-03T17:22:56.440

Link: CVE-2026-4535

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T21:18:14Z

Weaknesses