CVE-2026-6137

Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow

View on CVE.org
Published Apr 12, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromAdvSetWan of the file /goform/AdvSetWan. The manipulation of the argument wanmode/PPPOEPassword results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the fromAdvSetWan function of Tenda F451 firmware, triggered by manipulated wanmode or PPPOEPassword parameters sent to the /goform/AdvSetWan endpoint. The flaw belongs to CWE‑119 and CWE‑121 weaknesses, allowing an attacker to corrupt the stack and inject arbitrary code. Because the vulnerable interface is reachable over the network, exploitation can be performed from an external host without local access, enabling control over the device and its internal network resources.

Affected Systems

The vulnerability affects Tenda F451 routers running firmware version 1.0.0.7_cn_svn7958. Only this specific firmware release is known to contain the vulnerability; newer releases may have addressed it.

Risk and Exploitability

The severity of the flaw is reflected in a CVSS score of 8.7, denoting high risk. Exploitation is feasible remotely, and public exploits are available, indicating that attackers could gain unrestricted control of the device. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the combination of remote attack vector, high CVSS, and public exploit suggests a substantial threat to confidentiality, integrity, and availability.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Tenda firmware update that removes the stack-based buffer overflow in the AdvSetWan handler.
  • If an update is not yet available, block or restrict access to the /goform/AdvSetWan endpoint using firewall rules or network segmentation.
  • Disable WAN mode changes through the web interface or enforce strong authentication for management access.
  • Monitor router logs for suspicious requests to the AdvSetWan endpoint to detect potential exploitation attempts.

Generated by OpenCVE AI on April 13, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f451_firmware:1.0.0.7:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda f451
Vendors & Products Tenda f451
Type Values Removed Values Added
Description A vulnerability was detected in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromAdvSetWan of the file /goform/AdvSetWan. The manipulation of the argument wanmode/PPPOEPassword results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Title Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow
First Time appeared Tenda
Tenda f451 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f451 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 13, 2026, 5:52 PM
Reserved
Apr 12, 2026, 7:23 AM

View source JSON

Updated
Apr 13, 2026, 5:51 PM

JSON

Status
Analyzed
Published
Apr 13, 2026, 12:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 13, 2026, 12:53 PM

JSON