CVE-2026-6124

Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow

View on CVE.org
Published Apr 12, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the HTTP server component of Tenda F451 firmware 1.0.0.7. The flaw is triggered in the fromSafeMacFilter function when an attacker manipulates the page/menufacturer argument sent to /goform/SafeMacFilter. Successful exploitation can lead to arbitrary code execution on the device. The weakness corresponds to CWE-119 (buffer overflow) and CWE-121 (stack-based buffer overflow).

Affected Systems

Devices running Tenda F451 firmware 1.0.0.7 are affected; this version is the only one mentioned for the vulnerability.

Risk and Exploitability

The CVSS score is 8.7, indicating a high severity. No EPSS score is provided, but the exploit has been publicly disclosed and remains available for use. It is not listed in the CISA KEV catalog, yet the remote nature of the attack and public availability of exploit code elevate its risk. An attacker can reach the vulnerable interface over the network and exploit it from anywhere, potentially gaining full control over the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the firmware to the latest version that addresses the SafeMacFilter overflow.
  • If a firmware upgrade is not immediately possible, restrict remote access to the device’s web interface with firewall rules or network segmentation.
  • Monitor device logs for attempts to exploit the SafeMacFilter endpoint and apply any emerging vendor advisories promptly.

Generated by OpenCVE AI on April 12, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f451_firmware:1.0.0.7:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda f451
Vendors & Products Tenda f451
Type Values Removed Values Added
Description A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Title Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow
First Time appeared Tenda
Tenda f451 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 4:33 PM
Reserved
Apr 11, 2026, 4:03 PM

View source JSON

Updated
Apr 14, 2026, 3:18 PM

JSON

Status
Analyzed
Published
Apr 12, 2026, 9:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 13, 2026, 12:56 PM

JSON