CVE-2026-6120

Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow

View on CVE.org
Published Apr 12, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in Tenda F451 1.0.0.7. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

A stack‑based buffer overflow exists in the fromDhcpListClient function of the httpd component on Tenda F451 routers running firmware 1.0.0.7. By sending a specially crafted page parameter to the /goform/DhcpListClient endpoint, an attacker can corrupt the stack and may be able to execute arbitrary code on the device. The flaw is identified by CWE‑119 and CWE‑121.

Affected Systems

The vulnerability targets Tenda F451 routers with firmware version 1.0.0.7. The affected component is the HTTP server’s DhcpListClient handler exposed through the web management interface.

Risk and Exploitability

The CVSS base score of 8.7 classifies the issue as high severity. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, yet a public exploit has been disclosed. The attack can be launched remotely via the web interface, which could potentially lead to code execution on the device and compromise the device or its network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Tenda that patches the DhcpListClient buffer overflow.
  • If a firmware update is not yet available, disable remote web management or restrict access to the HTTP interface using firewall rules or network segmentation.
  • After applying the update or restriction, monitor the device for abnormal activity such as unexpected processes or outbound connections.
  • Verify the authenticity of any firmware before installation by checking vendor‑provided checksums or signatures.

Generated by OpenCVE AI on April 12, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f451_firmware:1.0.0.7:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda f451
Vendors & Products Tenda f451
Type Values Removed Values Added
Description A vulnerability was detected in Tenda F451 1.0.0.7. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
Title Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow
First Time appeared Tenda
Tenda f451 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 13, 2026, 5:51 PM
Reserved
Apr 11, 2026, 4:03 PM

View source JSON

Updated
Apr 13, 2026, 5:51 PM

JSON

Status
Analyzed
Published
Apr 12, 2026, 6:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 13, 2026, 12:56 PM

JSON