CVE-2026-5988

Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow

View on CVE.org
Published Apr 9, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

A stack‑based buffer overflow exists in the formWrlsafeset function of Tenda F451 firmware version 1.0.0.7. Manipulating the mit_ssid argument when the /goform/AdvSetWrlsafeset web form is invoked causes an overflow on the stack. The flaw is publicly available and can be triggered remotely, potentially enabling arbitrary code execution or a denial of service.

Affected Systems

The vulnerability affects Tenda F451 routers running firmware 1.0.0.7. No other product or version information is provided in the advisory.

Risk and Exploitability

The CVSS score of 8.7 reflects a high severity level. EPSS information is not available and the CVE is not listed in the CISA KEV catalog. The remote nature of the attack vector suggests attackers can target the device over the network without local access, and exploitation requires only a crafted request to the vulnerable web interface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the Tenda website or support channels for an official firmware update that resolves the stack overflow. Apply the latest firmware promptly.
  • If a patch is not available, block or restrict external access to the router’s web management interface, especially the /goform/AdvSetWrlsafeset endpoint, to prevent remote exploitation.
  • Monitor network traffic for requests targeting the vulnerable endpoint and look for anomalous activity indicative of exploitation attempts.

Generated by OpenCVE AI on April 10, 2026 at 00:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f451_firmware:1.0.0.7:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda f451
Vendors & Products Tenda f451
Type Values Removed Values Added
Description A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
Title Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow
First Time appeared Tenda
Tenda f451 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 4:33 PM
Reserved
Apr 9, 2026, 12:36 PM

View source JSON

Updated
Apr 14, 2026, 3:16 PM

JSON

Status
Analyzed
Published
Apr 9, 2026, 11:17 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 10, 2026, 9:27 AM

JSON