---METADATA---
VENDOR: Tenda
PRODUCT: F1202
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Tenda F1202 router could allow an attacker to bypass security measures and perform unauthorized actions.

Executive Summary:
A critical vulnerability in the Tenda F1202 router could allow an attacker to gain unauthorized control, compromising the security of the local network.

Vulnerability Details

CVE-ID: CVE-2026-9431

Affected Software: Tenda F1202

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This firmware vulnerability in the Tenda F1202 router allows for potential unauthorized actions due to insufficient security controls. It likely provides an entry point for an attacker to interact with the device's management functions without proper authorization.

Business Impact

Given the CVSS score of 8.8, this flaw is highly critical. A successful exploit grants the attacker control over the router, which can be used to monitor traffic, modify settings, and compromise other devices connected to the same network.

Remediation Plan

Immediate Action: Apply the latest firmware update for the Tenda F1202 as soon as it is released by the manufacturer.

Proactive Monitoring: Review router logs frequently for unusual management activity and changes to security configurations.

Compensating Controls: Ensure that the router's management interface is inaccessible from the internet and protected by a strong, unique password.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining the integrity of network gateways is a high priority for security teams. Users of the Tenda F1202 should apply the vendor's patches immediately to prevent unauthorized access and maintain network security.

---METADATA---
VENDOR: Tenda
PRODUCT: F1202
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been determined in the Tenda F1202 router, potentially allowing for remote exploitation of the device.

Executive Summary:
A critical vulnerability in the Tenda F1202 router poses a high risk of unauthorized device control and potential network-wide security compromise.

Vulnerability Details

CVE-ID: CVE-2026-9430

Affected Software: Tenda F1202

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability in the Tenda F1202 firmware likely involves an authentication or input validation flaw that enables unauthorized access to sensitive router functions. Such issues can often be exploited to manipulate router settings or execute code.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as high-risk. Successful exploitation allows an attacker to compromise the gateway between the internal network and the internet, facilitating traffic interception and further attacks on internal resources.

Remediation Plan

Immediate Action: Update the Tenda F1202 firmware to the latest available version as provided by the vendor.

Proactive Monitoring: Monitor internal network traffic for signs of unauthorized access or anomalous activity originating from the router.

Compensating Controls: Restrict management interface access to a secure, internal-only management network segment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize the security of their perimeter devices. The Tenda F1202 must be patched immediately to close this vulnerability and protect the network from potential exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F1202
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Tenda F1202 router, potentially allowing an attacker to execute unauthorized commands or access sensitive data.

Executive Summary:
A critical vulnerability in the Tenda F1202 router presents a significant risk of device compromise and unauthorized network access.

Vulnerability Details

CVE-ID: CVE-2026-9429

Affected Software: Tenda F1202

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in the Tenda F1202 firmware that potentially permits unauthorized access or command execution. This flaw typically resides in the device's web management interface, which is a common vector for remote exploitation.

Business Impact

The CVSS score of 8.8 indicates a high-risk scenario where an attacker could gain persistent control over the network. The resulting impact includes the potential loss of data confidentiality and the ability for the attacker to move laterally within the network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Tenda to all affected F1202 units.

Proactive Monitoring: Monitor network traffic for unusual activity and regularly check the router’s configuration for unauthorized modifications.

Compensating Controls: Disable WAN-side administration and implement strong, unique passwords for the administrative interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Patching the Tenda F1202 is essential to prevent unauthorized access and protect the overall security posture of the network.

---METADATA---
VENDOR: Tenda
PRODUCT: F1202
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been discovered in the Tenda F1202 router, which may allow an attacker to compromise the device's integrity.

Executive Summary:
A critical vulnerability in the Tenda F1202 router could allow an attacker to gain unauthorized control, risking the security of the entire local network.

Vulnerability Details

CVE-ID: CVE-2026-9428

Affected Software: Tenda F1202

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Tenda F1202 router firmware. The nature of the flaw allows for potential unauthorized actions, which could range from configuration manipulation to arbitrary code execution, depending on the specific entry point.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a high risk. Compromise of the router allows an attacker to control the flow of network traffic, potentially leading to data theft, credential harvesting, and the infiltration of other connected devices within the network.

Remediation Plan

Immediate Action: Update the firmware of the Tenda F1202 to the latest version provided by the manufacturer.

Proactive Monitoring: Review router access logs for suspicious administrative activity and monitor for unauthorized changes to security settings.

Compensating Controls: Ensure the router is not accessible from the public internet and restrict access to the web management interface to trusted local IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Router vulnerabilities are critical due to their position as the gateway to the internal network. Tenda F1202 owners should apply the necessary firmware updates immediately to mitigate the threat of unauthorized access and network compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Tenda F456 routers, potentially exposing the device to unauthorized administrative control.

Executive Summary:
A critical security vulnerability in the Tenda F456 router may allow an attacker to gain unauthorized access or control over the device.

Vulnerability Details

CVE-ID: CVE-2026-9389

Affected Software: Tenda F456

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to a security flaw in the firmware of the Tenda F456. While specific technical details are pending, such vulnerabilities in consumer-grade routers typically involve authentication bypass or command injection flaws.

Business Impact

With a CVSS score of 8.8, the potential for full device compromise is significant. An attacker who gains control of the router can intercept traffic, perform man-in-the-middle attacks, and pivot into the internal network, causing severe risk to all connected endpoints.

Remediation Plan

Immediate Action: Check the Tenda support website for firmware updates and apply them to all F456 devices immediately.

Proactive Monitoring: Monitor for unexpected traffic patterns or changes to device configuration settings that suggest unauthorized tampering.

Compensating Controls: Disable remote management features on the router and ensure that the administrative interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network perimeter devices are high-value targets for attackers. Users of Tenda F456 hardware should prioritize the deployment of vendor-supplied patches to secure their local network gateway against potential remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: HG10
AFFECTED_VERSIONS: 300001138
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-04T09:10:28.815Z
CREDITS: sunnyyaya (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/398316","name":"VDB-398316 | Tenda HG10 Boa Web Server formWlanSetup buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/398316/cti","name":"VDB-398316 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-85110","name":"CVE-2026-85110 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/891995","name":"Submit #891995 | Tenda HG10 HG7_HG9_HG10re_300001138 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formWlanSetup-ssid.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A buffer overflow in the Tenda HG10 web server allows authenticated attackers to cause a denial of service or potentially execute arbitrary code via the ssid parameter.

Executive Summary:
A high-severity buffer overflow vulnerability in Tenda HG10 routers allows for remote exploitation, posing a significant risk of service disruption or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-85110

Affected Software: Tenda HG10

Affected Versions: 300001138

Vulnerability: The vulnerability exists within the Boa web server component, specifically in the formWlanSetup function, where the ssid parameter is copied to a fixed-size buffer without sufficient length validation. An authenticated attacker can trigger this memory corruption by sending a crafted HTTP POST request to the affected endpoint.

Business Impact

The exploitation of this vulnerability can result in a complete denial of service, rendering the network device unresponsive and disrupting critical business communications. Given the CVSS score of 8.8, the potential for arbitrary code execution poses a severe risk of unauthorized access to the network infrastructure, which could lead to data exfiltration or lateral movement within the environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /boaform/formWlanSetup endpoint and watch for unexpected device reboots or service outages.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter or block HTTP requests containing abnormally long ssid parameter values.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of September 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the lack of bounds checking on user-supplied input in a core administrative function.

Analyst Recommendation

This vulnerability represents a significant security risk for Tenda HG10 users. Because an exploit is publicly available and the impact includes potential code execution, IT teams must prioritize securing the management interface immediately. Implement the suggested compensating controls and monitor for vendor updates to address this flaw as soon as a firmware fix is released.

---METADATA---
VENDOR: Tenda
PRODUCT: HG10
AFFECTED_VERSIONS: 300001138
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-04T09:04:03.777Z
CREDITS: sunnyyaya (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/398315","name":"VDB-398315 | Tenda HG10 Boa Web Server formLogin buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/398315/cti","name":"VDB-398315 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-85109","name":"CVE-2026-85109 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/891994","name":"Submit #891994 | Tenda HG10 HG7_HG9_HG10re_300001138 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formLogin_username.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A buffer overflow in the Tenda HG10 Boa web server allows unauthenticated remote attackers to trigger a denial of service or potentially execute arbitrary code via the username parameter.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda HG10 router allows unauthenticated remote attackers to crash the device or potentially execute arbitrary code, posing a severe risk to network availability.

Vulnerability Details

CVE-ID: CVE-2026-85109

Affected Software: Tenda HG10

Affected Versions: 300001138

Vulnerability: This memory corruption flaw exists within the Boa web server component, specifically in the formLogin function. An unauthenticated attacker can supply an excessively long username parameter via a POST request to the /boaform/formLogin endpoint, leading to a buffer overflow.

Business Impact

The ability for an unauthenticated attacker to remotely crash a network device leads to significant operational downtime and service disruption. Given the CVSS score of 9.8, this vulnerability represents a critical risk, as it allows for total loss of availability and potential full system compromise, which could facilitate further lateral movement within the internal network.

Remediation Plan

Immediate Action: Contact Tenda support or check the official Tenda website for available firmware updates to address this vulnerability. If no patch is currently available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boaform/formLogin endpoint. Additionally, configure alerts for unexpected device reboots or service outages that may indicate successful exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing overly long username parameters. Disable remote management access to the router to ensure the interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Analyst Notes: As of Sep 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform length validation on the user-supplied username parameter before copying it into a fixed-size memory buffer.

Analyst Recommendation

Due to the critical nature of this buffer overflow and the availability of a public proof-of-concept, immediate action is required to secure affected Tenda HG10 devices. Administrators should prioritize the application of vendor-supplied firmware updates and restrict administrative access to the device web interface to prevent unauthorized remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: AC18
AFFECTED_VERSIONS: 15.03.05.19
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:49.046Z
CREDITS: ST4R0003 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397183","name":"VDB-397183 | Tenda AC18 Telnet telnet missing authentication","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/397183/cti","name":"VDB-397183 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82695","name":"CVE-2026-82695 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894242","name":"Submit #894242 | Tenda AC18 ac18_kf_V15.03.05.19 Missing Authentication for Critical Function","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A critical missing authentication vulnerability in the Tenda AC18 router allows remote, unauthenticated attackers to enable and access the Telnet management shell via the /goform/telnet endpoint.

Executive Summary:
The Tenda AC18 router is susceptible to a critical unauthenticated remote command execution vulnerability that allows an attacker to enable the Telnet service and gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-82695

Affected Software: Tenda AC18

Affected Versions: 15.03.05.19

Vulnerability: The vulnerability exists within the /goform/telnet handler of the /bin/httpd component. An unauthenticated attacker can send a direct HTTP request to this endpoint to trigger shell commands that start the Telnet daemon, effectively bypassing all authentication controls.

Business Impact

The exploitation of this vulnerability results in a complete compromise of the router, allowing an attacker to gain full administrative control over the network gateway. Given the CVSS score of 10.0, this flaw poses an extreme risk, as it permits unauthorized remote access, potential data interception, and the ability to use the compromised device as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Disconnect the affected Tenda AC18 router from the internet and update the firmware to the latest available version provided by the vendor. If an update is not immediately available, disable all remote management features and restrict access to the web interface to trusted management IP addresses only.

Proactive Monitoring: Review system access logs for any unauthorized HTTP requests directed at the /goform/telnet endpoint. Monitor the device for unexpected Telnet connections or abnormal traffic patterns originating from the router.

Compensating Controls: Implement a Web Application Firewall (WAF) or an edge firewall rule to block all incoming traffic to the /goform/telnet path. Ensure that the device is not exposed to the public internet by placing it behind a more secure enterprise-grade firewall.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the technical write-up published on GitHub.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the simple HTTP request structure required to trigger the command execution.

Analyst Recommendation

The severity of this vulnerability is critical, and the availability of a public proof-of-concept significantly increases the likelihood of opportunistic exploitation. IT administrators should prioritize the remediation of all affected Tenda AC18 devices immediately to prevent unauthorized access and potential network-wide compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: AC1206
AFFECTED_VERSIONS: 15.03.06.23
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:41.321Z
CREDITS: ST4R0003 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397182","name":"VDB-397182 | Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397182/cti","name":"VDB-397182 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82694","name":"CVE-2026-82694 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894241","name":"Submit #894241 | Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Ex","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-ATE-DEFAULT-UNAUTH-002-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the Tenda AC1206 Web UI allows unauthenticated remote attackers to trigger manufacturing functions via the /goform/ate endpoint.

Executive Summary:
An unauthenticated, critical remote command execution vulnerability exists in Tenda AC1206 firmware version 15.03.06.23 due to a missing authentication check on the manufacturing interface.

Vulnerability Details

CVE-ID: CVE-2026-82694

Affected Software: Tenda AC1206

Affected Versions: 15.03.06.23

Vulnerability: The vulnerability resides in the R7WebsSecurityHandler function within the Web UI component, which fails to enforce authentication for the /goform/ate endpoint. An unauthenticated attacker can invoke this endpoint to trigger manufacturing tasks, including system commands such as reboot, factory reset, and NVRAM manipulation, which may lead to full device compromise.

Business Impact

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary system commands with the privileges of the web service. Given the CVSS score of 10.0, this represents a total compromise of the affected device, potentially leading to unauthorized network access, data interception, and total loss of device availability. Such an impact is severe for enterprise and home environments relying on the device for secure connectivity.

Remediation Plan

Immediate Action: Update the Tenda AC1206 firmware to the latest available version provided by the vendor. If an update is not currently available, immediately restrict access to the device management interface from untrusted networks.

Proactive Monitoring: Monitor network traffic for anomalous UDP activity on port 7329, which is the default port opened by the vulnerable manufacturing service. Review system logs for unauthorized configuration changes or unexpected device reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) or network access control list to block unauthorized requests to the /goform/ate endpoint. Ensure that the device administrative interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a proof of concept and technical documentation are available via the research write-up published on GitHub.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no interaction or credentials to trigger the underlying manufacturing tasks.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of public technical details, immediate action is required. Organizations using the Tenda AC1206 should prioritize applying the vendor provided firmware update or implementing strict network segmentation to prevent unauthorized access to the web management interface. Failure to remediate this issue leaves the device susceptible to complete remote takeover.

---METADATA---
VENDOR: Tenda
PRODUCT: AC1206
AFFECTED_VERSIONS: 15.03.06.23
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:56.793Z
CREDITS: ST4R0003 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397181","name":"VDB-397181 | Tenda AC1206 Web UI telnet TendaTelnet missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397181/cti","name":"VDB-397181 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82693","name":"CVE-2026-82693 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894235","name":"Submit #894235 | Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Mi","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A vulnerability in Tenda AC1206 firmware 15.03.06.23 allows unauthenticated remote attackers to enable the Telnet service via the /goform/telnet endpoint, potentially leading to unauthorized access.

Executive Summary:
A critical authentication bypass vulnerability in Tenda AC1206 routers allows unauthenticated attackers to enable the Telnet service, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-82693

Affected Software: Tenda AC1206

Affected Versions: 15.03.06.23

Vulnerability: The vulnerability exists within the TendaTelnet function of the Web UI, which is reachable via the /goform/telnet file. When the router is in a factory-default state without a configured administrator password, an unauthenticated attacker can trigger this endpoint to enable and start the Telnet daemon.

Business Impact

Successful exploitation allows an attacker to enable a management service that should not be exposed, significantly expanding the device attack surface. By gaining access to the Telnet interface, an attacker may be able to execute arbitrary commands, bypass further security controls, or gain persistent control over the network infrastructure. Given the CVSS score of 10.0, this represents a critical risk that could lead to complete loss of confidentiality, integrity, and availability for the affected network device.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch for this specific issue; administrators should immediately secure the device by setting a strong, non-default administrator password to prevent the default-state condition that permits this exploit.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts to the management interface, specifically looking for GET requests to the /goform/telnet endpoint. Review system logs for unexpected initialization of the Telnet daemon.

Compensating Controls: Restrict access to the router Web UI to trusted management IP addresses only and ensure the device is not exposed to the public internet. If possible, disable Telnet at the firmware level if it is not required for operational purposes.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing the attack methodology and proof-of-concept details is available via the linked research documentation.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication or user interaction.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized Telnet access. Because no official patch is currently available, administrators must prioritize hardening their device configuration by enforcing strong authentication immediately. Failure to secure the management interface creates a trivial path for attackers to gain administrative control over the network gateway.

---METADATA---
VENDOR: Tenda
PRODUCT: HG10
AFFECTED_VERSIONS: 300001138
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:00:58.836Z
CREDITS: sunnyyaya (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397058","name":"VDB-397058 | Tenda HG10 Boa Web Server formIPv6Routing buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397058/cti","name":"VDB-397058 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82542","name":"CVE-2026-82542 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/888876","name":"Submit #888876 | Tenda HG10 HG7_HG9_HG10re_300001138 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formIPv6Route-destNt.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda HG10 Boa web server allows unauthenticated remote attackers to trigger a denial of service via the formIPv6Routing interface.

Executive Summary:
A critical remote buffer overflow vulnerability in Tenda HG10 routers poses a severe risk of system compromise and denial of service.

Vulnerability Details

CVE-ID: CVE-2026-82542

Affected Software: Tenda HG10

Affected Versions: 300001138

Vulnerability: This memory corruption flaw exists in the formIPv6Routing function of the Boa web server, where insufficient validation of the destNet parameter allows an unauthenticated remote attacker to overflow a fixed-size buffer.

Business Impact

Successful exploitation of this buffer overflow can lead to a complete denial of service, rendering the device unresponsive and disrupting network connectivity for all dependent users. Given the CVSS score of 10.0, the potential for arbitrary code execution poses a critical risk to data integrity and network security, as attackers could gain unauthorized control over the routing infrastructure.

Remediation Plan

Immediate Action: Contact Tenda support or monitor the official vendor website for a firmware update that addresses this buffer overflow in the Boa web server.

Proactive Monitoring: Inspect network traffic for unusually large POST requests directed at the /boaform/admin/formIPv6Routing endpoint and monitor device logs for unexpected reboots or system crashes.

Compensating Controls: Restrict access to the device administration interface to trusted internal IP addresses using firewall rules, and employ a Web Application Firewall (WAF) to filter malformed HTTP requests containing excessively long parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by SunnyYANGyaya.

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation in the wild. However, the presence of a functional proof-of-concept demonstrating a denial of service condition makes this vulnerability highly concerning and easily reproducible for malicious actors.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of public exploit details, immediate action is required to secure affected Tenda HG10 devices. Organizations should prioritize isolating these units from the public internet until a firmware patch is applied to prevent potential remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: CX12L
AFFECTED_VERSIONS: Tenda CX12L: 16.03.53.12
CONFIDENCE: high
MISSING: patch, technical_details
CREDITS: lv1020 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361927","name":"VDB-361927 | Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361927/cti","name":"VDB-361927 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/808867","name":"Submit #808867 | Tenda CX12L V16.03.53.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/cve-a/lvdan/issues/6","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:25:05.059Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda CX12L routers allows remote attackers to execute arbitrary code via the startIp parameter in the SetPptpServerCfg endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda CX12L router allows remote attackers to achieve arbitrary code execution and compromise the device.

Vulnerability Details

CVE-ID: CVE-2026-8138

Affected Software: Tenda CX12L

Affected Versions: Tenda CX12L: 16.03.53.12

Vulnerability: A stack-based buffer overflow exists within the formSetPPTPServer function at the /goform/SetPptpServerCfg endpoint, triggered by unbounded input processing of the startIp parameter by an unauthenticated attacker.

Business Impact

A successful exploit can result in full device compromise, allowing malicious actors to manipulate network traffic, intercept sensitive communications, or use the compromised router as a pivot point for lateral movement into the internal network. The high CVSS score of 8.8 reflects the severe potential for total system control and remote execution without requiring prior authentication.

Remediation Plan

Immediate Action: Apply firmware updates from the vendor as soon as they become available, or restrict management interfaces from external exposure.

Proactive Monitoring: Monitor network traffic for anomalous request patterns targeting the /goform/SetPptpServerCfg endpoint and watch for unexpected device reboots indicating denial of service attempts.

Compensating Controls: Deploy a Web Application Firewall or network access control lists to block malicious HTTP requests containing oversized startIp parameters destined for the management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub issue references.

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from unsafe memory handling in string parsing routines.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency given the potential for remote code execution and network compromise. Since no official patch version is detailed in the current advisory, network perimeter controls should be enforced immediately to isolate affected devices from untrusted networks until vendor firmware updates can be applied.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: ysnysnysn (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/394524","name":"VDB-394524 | Tenda CH22 exeCommand formexeCommand command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/394524/cti","name":"VDB-394524 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-78141","name":"CVE-2026-78141 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/882284","name":"Submit #882284 | Tenda CH22 V1.0.0.1 Command Injection","tags":["third-party-advisory"]},{"url":"https://candle-throne-f75.notion.site/Tenda-CH22-formexeCommand-396df0aa11858036b0cdf7a7562d4a67","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
The Tenda CH22 router contains a command injection vulnerability in the web interface that allows an authenticated attacker to execute arbitrary system commands.

Executive Summary:
An authenticated command injection vulnerability in the Tenda CH22 router allows for the execution of unauthorized system commands.

Vulnerability Details

CVE-ID: CVE-2026-78141

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The device suffers from a command injection flaw within the formexeCommand function, which permits an authenticated attacker to inject and execute system-level commands through the web interface.

Business Impact

A successful exploit allows an attacker with low-level credentials to escalate their control over the device. With a CVSS score of 7.4, this vulnerability presents a high risk to network integrity, potentially enabling attackers to pivot into the internal network or manipulate traffic flowing through the router.

Remediation Plan

Immediate Action: Contact Tenda support or check the official manufacturer website for firmware updates to address this command injection flaw.

Proactive Monitoring: Monitor system logs for unexpected process execution or unauthorized configuration changes.

Compensating Controls: Implement strict network segmentation and ensure that the router administration interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in a technical writeup.

Analyst Notes: As of August 24, 2026, there is no public information indicating active exploitation in the wild; however, a proof-of-concept is publicly available. The vulnerability is highly exploitable given the lack of sufficient input sanitization in the formexeCommand function.

Analyst Recommendation

This vulnerability highlights the risk of insufficient input validation on network hardware. Organizations using the Tenda CH22 should prioritize firmware updates or apply network-level access controls to mitigate the risk of command execution by unauthorized or compromised accounts.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the Tenda CH22 router allows authenticated attackers to execute arbitrary system commands via the formEditFileName function.

Executive Summary:
A command injection flaw in the Tenda CH22 router, version 1.0.0.1, presents a high risk of unauthorized system command execution by authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-78063

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: This vulnerability is a command injection flaw (CWE-77) triggered through the formEditFileName function. The CVSS vector confirms that an attacker must possess low-level privileges to successfully execute arbitrary commands on the affected device.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the network device, potentially leading to a complete compromise of the router. Given the CVSS score of 7.4, this vulnerability poses a significant threat to internal network security, as attackers could intercept traffic, modify configurations, or pivot to other systems on the network.

Remediation Plan

Immediate Action: Contact Tenda support or monitor the official Tenda website for a firmware update that addresses the command injection vulnerability in the CH22 model.

Proactive Monitoring: Inspect system logs for unusual administrative activity or unexpected shell command execution patterns originating from authenticated sessions.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and enforce strong password policies for all authenticated users to limit the potential for unauthorized privilege acquisition.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically exploitable, there is no confirmed weaponized exploit available in curated repositories.

Analyst Recommendation

Due to the severity of command injection vulnerabilities, it is critical to prioritize the installation of vendor-provided patches as soon as they become available. Until an update is released, administrators should strictly limit access to the device management interface to minimize the attack surface.

---METADATA---
VENDOR: Tenda
PRODUCT: 4G300
AFFECTED_VERSIONS: US_4G300V1.0Mt_V1.01.42_CN_TDC01
CONFIDENCE: high
MISSING: patch
CREDITS: Haaalion (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360206","name":"VDB-360206 | Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360206/cti","name":"VDB-360206 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804269","name":"Submit #804269 | Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Axelioc/CVE/blob/main/Tenda/US_4G300/sub_427C3C/sub_427C3C.md","name":null,"tags":["broken-link","exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.647Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda 4G300 router allows remote code execution via manipulation of the page argument in the SafeMacFilter function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda 4G300 router allows authenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-7470

Affected Software: Tenda 4G300

Affected Versions: US_4G300V1.0Mt_V1.01.42_CN_TDC01

Vulnerability: The vulnerability exists within the sub_427C3C function of the /goform/SafeMacFilter file, where improper validation of the page argument leads to a stack-based buffer overflow. This attack requires the user to have low privileges (authenticated) to access the vulnerable administrative interface.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary code on the affected router, potentially leading to full device compromise. Given the CVSS score of 8.8, this represents a high-severity risk that could result in unauthorized network access, data interception, or the use of the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface of the Tenda 4G300 to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual patterns directed at the /goform/SafeMacFilter endpoint and review system logs for signs of repeated crashes or abnormal process behavior.

Compensating Controls: Deploy a Web Application Firewall or similar filtering mechanism to sanitize or block requests containing excessively long strings in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the security references.

Analyst Notes: As of May 1, 2026, there is no confirmed active exploitation in the wild, but a functional proof-of-concept has been published by researchers. The vulnerability is highly exploitable due to the nature of stack-based buffer overflows, which can be weaponized for remote code execution.

Analyst Recommendation

Due to the lack of an official patch and the availability of a public proof-of-concept, the risk to Tenda 4G300 deployments is significant. Security teams should prioritize isolating these devices from external access and implementing strict network access controls until the vendor provides a firmware update to resolve the memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: HG3
AFFECTED_VERSIONS: 2.0
CONFIDENCE: high
MISSING: patch
CREDITS: 2er00ne (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359759","name":"VDB-359759 | Tenda HG3 formTracert command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359759/cti","name":"VDB-359759 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/802079","name":"Submit #802079 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 Remote code execution","tags":["third-party-advisory"]},{"url":"https://www.notion.so/33e0c75766a880488924cf24523acf6c","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.699Z
---END_METADATA---

Description Summary:
Tenda HG3 version 2.0 contains a command injection vulnerability in the formTracert function within the /boaform/formTracert file, which can be triggered via a manipulated datasize argument.

Executive Summary:
A critical command injection vulnerability in Tenda HG3 version 2.0 allows remote attackers to execute arbitrary system commands, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-7160

Affected Software: Tenda HG3

Affected Versions: 2.0

Vulnerability: The flaw exists due to improper input validation in the formTracert function, specifically within the datasize argument. An attacker with low privileges can perform remote command injection to execute unauthorized code on the affected device.

Business Impact

The ability to execute arbitrary commands remotely grants an attacker full control over the affected Tenda HG3 router. This level of compromise can lead to complete network traffic interception, unauthorized access to internal resources, and the potential for the device to be co-opted into a botnet. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk to operational stability and network security.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should restrict network access to the management interface of the affected device and monitor for any available firmware updates from the vendor website.

Proactive Monitoring: Implement network traffic analysis to detect unusual outbound connections or suspicious command patterns originating from the router.

Compensating Controls: Deploy a Web Application Firewall or adjust firewall rules to block access to the /boaform/formTracert endpoint from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security write-up.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct interaction with the system shell via a web request.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability must be treated with urgency. Administrators should isolate the vulnerable Tenda HG3 units from external network exposure until a vendor-supplied firmware update is verified and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: HG3
AFFECTED_VERSIONS: 2.0
CONFIDENCE: high
MISSING: patch
CREDITS: 2er00ne (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359750","name":"VDB-359750 | Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359750/cti","name":"VDB-359750 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/802058","name":"Submit #802058 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 dos","tags":["third-party-advisory"]},{"url":"https://www.notion.so/33e0c75766a88041bd86d3810994a541","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.699Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda HG3 function formUploadConfig allows remote attackers to trigger memory corruption via the destNet argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda HG3 routers enables remote attackers to execute unauthorized commands or cause system instability.

Vulnerability Details

CVE-ID: CVE-2026-7151

Affected Software: Tenda HG3

Affected Versions: 2.0

Vulnerability: The vulnerability exists in the formUploadConfig function within the /boaform/formIPv6Routing file. An attacker with low-level privileges can trigger a stack-based buffer overflow by sending a specially crafted request to the destNet argument.

Business Impact

Successful exploitation of this buffer overflow can result in complete system compromise or denial of service for the affected router. Given the CVSS score of 8.8, this vulnerability poses a significant risk to network availability and data integrity, potentially allowing attackers to intercept traffic or gain persistent access to the local network infrastructure.

Remediation Plan

Immediate Action: Contact Tenda support or monitor their official security portal for firmware releases addressing this overflow, as no official patch is currently identified.

Proactive Monitoring: Review firewall and access logs for suspicious traffic directed at the /boaform/formIPv6Routing endpoint, specifically monitoring for unusually long strings within the destNet parameter.

Compensating Controls: Implement strict network segmentation and restrict access to the device management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the technical write-up at the provided Notion documentation link.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of adequate input validation on the destNet argument.

Analyst Recommendation

The severity of this memory corruption vulnerability necessitates immediate attention. Organizations utilizing Tenda HG3 hardware should isolate affected devices from external network exposure until a vendor-supplied firmware update is available and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: HG3
AFFECTED_VERSIONS: Tenda HG3: 2.0
CONFIDENCE: high
MISSING: patch
CREDITS: 2er00ne (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359719","name":"VDB-359719 | Tenda HG3 formCountrystr os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359719/cti","name":"VDB-359719 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800859","name":"Submit #800859 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 Remote code execution","tags":["third-party-advisory"]},{"url":"https://www.notion.so/Tenda-HG3-1-33d0c75766a8808d8b38e9d090cec7ab","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
Tenda HG3 version 2.0 contains an OS command injection vulnerability in the /boaform/formCountrystr endpoint, allowing remote attackers to execute arbitrary system commands via the countrystr argument.

Executive Summary:
A critical OS command injection vulnerability in Tenda HG3 routers enables remote attackers to execute unauthorized commands, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7119

Affected Software: Tenda HG3

Affected Versions: Tenda HG3: 2.0

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered by improper validation of the countrystr argument within the /boaform/formCountrystr function. The CVSS vector (PR:L) indicates that the attacker must possess low-level privileges to successfully interact with the vulnerable endpoint.

Business Impact

The ability to perform OS command injection grants an attacker the power to execute arbitrary code with the privileges of the web server. This could lead to a complete takeover of the affected networking device, resulting in unauthorized network access, data exfiltration, or the use of the device as a pivot point for further attacks on the internal network. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to significant operational disruption and security breaches.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, users should restrict administrative access to the affected device management interface and disable remote access features.

Proactive Monitoring: Security teams should monitor network traffic for suspicious requests targeting the /boaform/formCountrystr endpoint and review system logs for unauthorized command execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network filtering rules to block or sanitize malicious input directed at the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the reference.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published PoC significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the severity of this command injection vulnerability and the availability of public proof-of-concept material, immediate defensive action is required. Organizations utilizing Tenda HG3 devices should isolate these systems from the public internet and apply vendor-provided updates as soon as they become available to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in Tenda F456 firmware version 1.0.0.5, which may allow for memory corruption and potential system compromise.

Executive Summary:
A critical memory corruption vulnerability in Tenda F456 firmware allows authenticated attackers to trigger a buffer overflow, potentially leading to unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-7101

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability consists of a buffer overflow and memory corruption (CWE-120/CWE-119) triggered via network-based input, requiring low-privileged user authentication to exploit.

Business Impact

Successful exploitation of this buffer overflow could lead to a crash or, more severely, the execution of arbitrary code with the privileges of the device's firmware. Given the CVSS score of 8.8, this poses a significant risk to the integrity and availability of the networking hardware, potentially allowing attackers to maintain persistence or intercept traffic.

Remediation Plan

Immediate Action: Check the Tenda support portal for available firmware updates; if no patch is available, restrict management access to the device to trusted administrative hosts only.

Proactive Monitoring: Monitor network traffic for unusual patterns or unexpected device reboots, which may indicate crash-based exploitation attempts.

Compensating Controls: Implement strict network access control lists (ACLs) to prevent unauthorized users from reaching the device management interface.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires authenticated access, which somewhat limits the immediate attack surface for external actors.

Analyst Recommendation

While this vulnerability requires authentication, the potential for memory corruption makes it a high-risk item. Administrators should prioritize updating the firmware to the latest version as soon as a vendor patch is released and enforce strict access controls in the interim.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359675","name":"VDB-359675 | Tenda F456 httpd Natlimit fromNatlimitof buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359675/cti","name":"VDB-359675 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798473","name":"Submit #798473 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_138/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 httpd component allows remote authenticated attackers to execute arbitrary code or cause a denial of service via the fromNatlimit function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7100

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The flaw exists within the fromNatlimit function of the httpd service, where a user-provided page parameter is passed to sprintf without proper length validation. An authenticated attacker can trigger this memory corruption by sending a crafted HTTP POST request to the /goform/Natlimit endpoint.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected device, potentially leading to a complete compromise of the router. Given the CVSS score of 8.8, the risk of unauthorized system access and persistent network control is severe, which may result in lateral movement within the local network or interception of sensitive traffic.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management interface of the F456 device to trusted internal segments only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/Natlimit endpoint and look for unexpected service restarts or abnormal system behavior.

Compensating Controls: Implement strict firewall rules to block unauthorized access to the web-based management interface, effectively preventing remote exploitation attempts.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher write-up linked in the CVE references.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the user-supplied input parameter.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators must isolate the vulnerable hardware from the public internet and apply vendor-supplied firmware updates as soon as they become available to remediate the underlying buffer overflow flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359674","name":"VDB-359674 | Tenda F456 httpd QuickIndex formQuickIndex buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359674/cti","name":"VDB-359674 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798472","name":"Submit #798472 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_137/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows authenticated remote attackers to execute code via a crafted mit_linktype parameter in the /goform/QuickIndex endpoint.

Executive Summary:
A critical buffer overflow vulnerability exists in Tenda F456 version 1.0.0.5 that could allow remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7099

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability is a stack-based buffer overflow occurring within the formQuickIndex function of the httpd component. By sending a malicious POST request to the /goform/QuickIndex endpoint with an oversized mit_linktype argument, an authenticated user can corrupt memory and potentially achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and confidentiality. An attacker who gains control over the router can intercept traffic, modify network configurations, or pivot into the internal network, leading to potential data breaches and widespread system compromise. Given the CVSS score of 8.8, this flaw is considered high-risk and requires immediate attention to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor website for available firmware updates to address this buffer overflow. If no patch is currently available, restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/QuickIndex endpoint. Review system logs for signs of service crashes or unexpected process restarts in the httpd component.

Compensating Controls: Implement strict access control lists on the network to prevent unauthorized users from accessing the router management interface. A Web Application Firewall or similar inspection tool may be used to filter anomalous traffic patterns targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's published technical write-up.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform boundary checks on user-supplied input before copying it into a stack-based buffer.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of exploitation by threat actors. Organizations utilizing the Tenda F456 router must prioritize the mitigation of this vulnerability by applying vendor-supplied updates as soon as they become available. In the absence of a patch, administrative access to the device must be severely restricted to prevent exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359673","name":"VDB-359673 | Tenda F456 httpd DhcpListClient fromDhcpListClient buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359673/cti","name":"VDB-359673 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798471","name":"Submit #798471 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_136/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.707Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the Tenda F456 router due to improper input validation in the fromDhcpListClient function, which could allow for remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 routers may allow remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7098

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the fromDhcpListClient function within the httpd component. An attacker can supply a crafted input to the page parameter, which is passed to the sprintf function without length validation, leading to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements, the flaw is remotely exploitable.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it enables remote code execution on the affected networking device. This could lead to full system compromise, unauthorized access to network traffic, and potential lateral movement into internal systems. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent device hijacking or service disruption.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the device management interface to trusted internal networks only. If not already performed, disable remote management features on the device.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /goform/DhcpListClient endpoint. Review system logs for unexpected crashes of the httpd service or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System (IPS) rule to inspect and block excessively long payloads sent to the /goform/DhcpListClient URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional proof-of-concept significantly lowers the barrier for attackers to develop a weaponized exploit.

Analyst Recommendation

Due to the severity of this remote code execution flaw and the public availability of technical details, immediate mitigation is required. Administrators should prioritize restricting management access to the affected Tenda F456 units and monitor vendor channels closely for the release of a firmware update addressing the buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359672","name":"VDB-359672 | Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359672/cti","name":"VDB-359672 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798470","name":"Submit #798470 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_135/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.719Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to trigger memory corruption and potential code execution via the page parameter in the webExcptypemanFilter function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a significant risk of remote code execution and system instability.

Vulnerability Details

CVE-ID: CVE-2026-7097

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow occurring within the httpd component, specifically in the fromwebExcptypemanFilter function. The vulnerability is triggered by providing an overly long input to the page argument, which lacks proper length validation before being processed by the sprintf function, allowing authenticated users to crash the service or achieve remote code execution.

Business Impact

The ability for an attacker to execute arbitrary code or cause a denial of service on network infrastructure devices presents a severe operational risk. Successful exploitation could lead to full device compromise, enabling lateral movement within the local network, interception of traffic, or complete loss of connectivity for dependent business services. Given the CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Since no official patch is currently identified, restrict access to the device management interface to trusted management subnets only to prevent external exploitation. Contact Tenda support or monitor the official support portal for firmware updates addressing this buffer overflow.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the /goform/webExcptypemanFilter endpoint, specifically looking for unusually long string payloads in the page parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing oversized payloads targeting the vulnerable URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's technical write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the underlying function performs no bounds checking on user-supplied input, making the creation of functional exploit code trivial for motivated actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a substantial threat to network integrity. Administrators should prioritize isolating affected Tenda F456 devices from the public internet immediately. Constant vigilance and the application of vendor-supplied patches, once available, are essential to mitigating this high-severity risk.

---METADATA---
VENDOR: Tenda
PRODUCT: HG3
AFFECTED_VERSIONS: 2.0 300003070
CONFIDENCE: high
MISSING: patch
CREDITS: 2er00ne (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359671","name":"VDB-359671 | Tenda HG3 formgponConf os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359671/cti","name":"VDB-359671 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800796","name":"Submit #800796 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 Remote code execution","tags":["third-party-advisory"]},{"url":"https://www.notion.so/Tenda-HG3-3250c75766a880c7b50fde0466557c5f","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.719Z
---END_METADATA---

Description Summary:
Tenda HG3 version 2.0 300003070 is vulnerable to remote OS command injection via the fmgpon_loid argument in the formgponConf function.

Executive Summary:
A critical OS command injection vulnerability in Tenda HG3 devices allows remote attackers to execute arbitrary commands, posing a significant risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7096

Affected Software: Tenda HG3

Affected Versions: 2.0 300003070

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) located in the /boaform/admin/formgponConf endpoint. An authenticated attacker can trigger the execution of arbitrary system commands by manipulating the fmgpon_loid argument.

Business Impact

The ability to perform remote command injection grants an attacker complete control over the affected device. This can lead to unauthorized network access, data interception, and the potential use of the device as a pivot point for further attacks on the internal network. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent full compromise of the affected hardware.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict network access to the management interface of the HG3 device to trusted internal segments only.

Proactive Monitoring: Monitor system logs for unusual process executions or unexpected changes to configuration files, particularly those originating from the /boaform/admin/ directory.

Compensating Controls: Deploy a Web Application Firewall or network access control list to block unauthorized access to the vulnerable /boaform/admin/formgponConf endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the vulnerability researchers.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the administrative configuration interface.

Analyst Recommendation

Given the availability of public proof-of-concept material and the severity of an OS command injection, the risk to Tenda HG3 users is substantial. Organizations must immediately isolate these devices from the public internet and verify if the vendor has provided updated firmware. Until a permanent patch is verified and applied, strict access controls are the most effective method for containing this threat.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359657","name":"VDB-359657 | Tenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359657/cti","name":"VDB-359657 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798465","name":"Submit #798465 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_134/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.719Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the Tenda F456 router, specifically within the httpd component, which could allow a remote attacker to execute arbitrary code or cause a denial of service.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a high risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7082

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the formWrlExtraSet function of the httpd service. An attacker with low privileges can trigger a stack-based buffer overflow by sending a crafted request containing a long string to the Go parameter via the /goform/WrlExtraSet endpoint, potentially leading to remote code execution.

Business Impact

Successful exploitation of this flaw allows an attacker to achieve remote code execution, granting them control over the affected network device. Given the high CVSS score of 8.8, this vulnerability could be leveraged to intercept network traffic, pivot into internal segments, or render the device unresponsive, significantly impacting business operations and network security.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the management interface by isolating the device from the public internet and ensuring it is only accessible via a secure, internal management VLAN.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlExtraSet endpoint and review system logs for signs of unexpected service restarts or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to detect and block oversized inputs sent to the Go parameter on the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on the user-provided input.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, as the availability of a public proof-of-concept significantly lowers the barrier for exploitation. Organizations should prioritize isolating the affected Tenda F456 devices from external networks and monitor vendor channels for the release of a security update. Failing to restrict access to this device may expose the internal network to unauthorized command execution.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359656","name":"VDB-359656 | Tenda F456 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359656/cti","name":"VDB-359656 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798464","name":"Submit #798464 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_133/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 httpd component allows remote code execution via a crafted dips argument in the fromGstDhcpSetSer function.

Executive Summary:
A buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7081

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability is a buffer overflow occurring in the httpd component within the fromGstDhcpSetSer function. An attacker with low-level privileges can trigger memory corruption by submitting a malformed dips parameter to the /goform/GstDhcpSetSer endpoint, potentially leading to remote code execution.

Business Impact

The ability to achieve remote code execution on network infrastructure devices is a severe security risk that can lead to full system compromise, unauthorized network access, and the potential for lateral movement within the environment. Given the high CVSS score of 8.8, this vulnerability represents a significant threat to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs for unusual traffic patterns targeting the /goform/GstDhcpSetSer endpoint, particularly large payloads within the dips parameter.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with custom rules to drop requests containing excessively long strings in the dips parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's technical write-up on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators must isolate the affected hardware from external exposure and monitor for any signs of attempted exploitation until the vendor releases a firmware update to resolve the buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359655","name":"VDB-359655 | Tenda F456 httpd PPTPUserSetting fromPPTPUserSetting buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359655/cti","name":"VDB-359655 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798463","name":"Submit #798463 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_132/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the delno parameter in the PPTPUserSetting function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 presents a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7080

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow occurring within the fromPPTPUserSetting function of the httpd component. By sending a crafted POST request to the /goform/PPTPUserSetting endpoint with an excessively long delno parameter, an authenticated attacker can trigger memory corruption to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability can lead to a complete compromise of the affected router, potentially granting an attacker persistent access to the network. Given the CVSS score of 8.8, the vulnerability is classified as High, reflecting the potential for total loss of system integrity and availability. This could result in unauthorized data interception, lateral movement within the network, or prolonged service outages for critical business operations.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the router management interface to trusted internal segments only. Disable the PPTP feature if it is not strictly required for business operations to reduce the attack surface.

Proactive Monitoring: Review web access logs for unusual POST requests directed at /goform/PPTPUserSetting. Monitor device stability for unexpected crashes or reboots that may indicate automated exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-based Intrusion Prevention System (IPS) rule to inspect and block excessively long input strings sent to the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of length validation on the user-supplied input before it is processed by the sprintf function.

Analyst Recommendation

The severity of this flaw and the public availability of exploit material necessitate immediate attention. Organizations utilizing Tenda F456 devices should prioritize network segmentation and the restriction of management access until the manufacturer releases a firmware update that addresses this buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359654","name":"VDB-359654 | Tenda F456 httpd AdvSetWan fromAdvSetWan buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359654/cti","name":"VDB-359654 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798461","name":"Submit #798461 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_130/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 httpd component allows remote attackers to execute arbitrary code or trigger a denial of service via the wanmode parameter in /goform/AdvSetWan.

Executive Summary:
A critical stack-based buffer overflow in the Tenda F456 router allows remote code execution and requires immediate attention to prevent unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-7079

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromAdvSetWan function of the httpd service, where user-supplied input to the wanmode and PPPOEPassword parameters is processed without adequate length validation. This memory corruption flaw can be triggered by an authenticated user to achieve remote code execution or cause a service crash.

Business Impact

The potential for remote code execution presents a severe risk of full device compromise, allowing an attacker to intercept network traffic, pivot into internal segments, or render the device inoperable. With a CVSS score of 8.8, this high-severity vulnerability poses a significant threat to organizational network integrity and operational continuity.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict management access to the device to trusted internal networks only and disable remote web interface access.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /goform/AdvSetWan endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection system to filter traffic and block requests that attempt to exploit buffer overflow conditions on the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept is available, so the exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the affected function.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a substantial risk to any environment utilizing the Tenda F456. Security teams must prioritize isolating these devices from external exposure until the vendor releases a security update that addresses the underlying memory safety issue.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359653","name":"VDB-359653 | Tenda F456 httpd SetIpBind fromSetIpBind buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359653/cti","name":"VDB-359653 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798460","name":"Submit #798460 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_129/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the Tenda F456 router within the fromSetIpBind function, which can be triggered remotely via the page parameter to cause memory corruption.

Executive Summary:
A critical remote buffer overflow vulnerability in the Tenda F456 router allows authenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7078

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability is a stack-based buffer overflow located in the fromSetIpBind function of the httpd component. An authenticated attacker can send a crafted POST request to the /goform/SetIpBind endpoint with an excessively long page argument, leading to memory corruption and potential remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk, as it allows an attacker to achieve remote code execution on the networking device. This can lead to full compromise of the router, enabling attackers to intercept network traffic, pivot into internal segments, or render the device unusable, causing significant operational downtime. Given the CVSS score of 8.8, this is a high-severity issue that requires immediate attention to prevent unauthorized access to the network infrastructure.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor website for a firmware update that addresses this buffer overflow; if no update is available, immediately restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/SetIpBind endpoint and review device logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement strict access control lists (ACLs) to limit management access to the router to authorized administrative IP addresses only, effectively mitigating the ability for unauthorized users to reach the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-supplied input.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the high potential for remote code execution, this vulnerability represents a significant threat to internal network security. Administrators should prioritize restricting management access to the device immediately and verify the availability of a patched firmware version from the vendor to remediate the underlying flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359630","name":"VDB-359630 | Tenda F456 httpd setcfm buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359630/cti","name":"VDB-359630 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798459","name":"Submit #798459 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_128/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.727Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 httpd service allows remote authenticated attackers to trigger memory corruption and potential code execution via the /goform/setcfm endpoint.

Executive Summary:
A buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a significant risk of remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7057

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the httpd component, specifically in the fromSetCfm function, which fails to perform adequate length validation on the funcname and funcpara1 parameters. This allows an attacker with low-level privileges to trigger a stack-based buffer overflow, potentially leading to remote code execution or a system crash.

Business Impact

The CVSS score of 8.8 indicates a high-severity threat that could lead to full system compromise. If exploited, an attacker could gain unauthorized control over the networking device, potentially leading to data interception, lateral movement within the local network, or complete loss of availability for the affected hardware.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the management interface of the Tenda F456 device to authorized personnel only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/setcfm endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Implement network segmentation to isolate the device from untrusted traffic and utilize a Web Application Firewall or similar inspection tool to block requests with anomalous parameter lengths.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up published on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of boundary checks on user-supplied input.

Analyst Recommendation

Given the high severity of this buffer overflow and the availability of a published proof-of-concept, users must prioritize securing the management interface of the affected device. While a vendor fix is pending, network-level isolation is the most effective method to prevent unauthorized exploitation of this flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359629","name":"VDB-359629 | Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359629/cti","name":"VDB-359629 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798458","name":"Submit #798458 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/798462","name":"Submit #798462 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow (Duplicate)","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_127/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.727Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to trigger a denial of service or execute arbitrary code via a crafted HTTP POST request to the SafeUrlFilter function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 firmware allows remote attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7056

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromSafeUrlFilter function of the /goform/SafeUrlFilter endpoint in the httpd component. By sending a crafted HTTP POST request with an overly long page parameter, a low-privileged attacker can trigger a memory corruption event, leading to potential remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe threat to network integrity, as it allows unauthorized remote code execution on the affected router. This could result in full device compromise, enabling attackers to intercept traffic, pivot into the internal network, or permanently disable critical connectivity infrastructure. With a CVSS score of 8.8, this flaw represents a high-risk entry point that requires immediate attention to prevent unauthorized access to the network perimeter.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor portal for firmware updates addressing this buffer overflow, as no official patch version is currently identified. If an update is unavailable, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the /goform/SafeUrlFilter endpoint. Review device logs for unexpected crashes or service restarts that may indicate successful or attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively large POST payloads directed at the vulnerable URL path.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-supplied input before memory operations.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-impact nature of remote code execution, this vulnerability poses a significant risk to network security. Administrators should prioritize securing the web management interface of the Tenda F456 and monitor for any vendor-issued firmware updates to permanently resolve the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359628","name":"VDB-359628 | Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359628/cti","name":"VDB-359628 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798457","name":"Submit #798457 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_126/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.727Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows authenticated remote attackers to cause a denial of service or execute arbitrary code via the /goform/VirtualSer endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F456 router allows authenticated remote attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7055

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The flaw resides in the fromVirtualSer function within the httpd component, where the page parameter is copied into a stack-based buffer without sufficient length validation. This vulnerability requires the attacker to be authenticated with low privileges to trigger the overflow through a crafted HTTP POST request.

Business Impact

The ability to execute arbitrary code on networking equipment poses a severe risk to organizational security, as it grants attackers a foothold to intercept traffic, pivot into internal network segments, or disrupt critical connectivity. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the potential for total system compromise. Successful exploitation could lead to unauthorized access to sensitive data and significant operational downtime for users relying on the affected hardware.

Remediation Plan

Immediate Action: Since a specific patch version is not currently available, administrators should restrict network access to the management interface of the Tenda F456 to trusted administrative IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests targeting the /goform/VirtualSer endpoint, particularly those containing unusually long string parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules or network-level access control lists (ACLs) to filter traffic and block malformed requests directed at the vulnerable router interface.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the security researcher's technical write-up on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of boundary checks on user-supplied input in the HTTP handler.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat to internal infrastructure. Organizations should immediately isolate the management interfaces of affected Tenda F456 devices and monitor for vendor updates to address this memory corruption flaw as soon as they become available.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359627","name":"VDB-359627 | Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359627/cti","name":"VDB-359627 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798456","name":"Submit #798456 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_125/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote, authenticated attackers to achieve remote code execution or a denial of service via the /goform/PPTPDClient endpoint.

Executive Summary:
A stack-based buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7054

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromPptpUserAdd function of the httpd component. By sending a crafted POST request to the /goform/PPTPDClient endpoint with an overly long username parameter while opttype is set to 1, an authenticated attacker can trigger a stack-based buffer overflow.

Business Impact

The potential for remote code execution (RCE) allows an attacker to gain full control over the affected network device. This level of compromise can lead to complete network traffic interception, unauthorized access to internal resources, and significant system instability. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could severely impact the security and integrity of the local network environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the device management interface to trusted IP addresses only and disable unnecessary services like PPTP if not required.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/PPTPDClient endpoint, specifically looking for unusually large payloads in the username field.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to inspect and block excessively long input strings sent to router administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a functional Proof of Concept (PoC) is publicly available via a researcher write-up hosted on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-provided input, which allows for direct memory corruption.

Analyst Recommendation

Due to the critical nature of this memory corruption vulnerability and the availability of a public exploit, immediate defensive measures are required. Organizations should prioritize isolating affected Tenda F456 units from untrusted networks and monitor for vendor-provided firmware updates to address the underlying code defect.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359626","name":"VDB-359626 | Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359626/cti","name":"VDB-359626 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798455","name":"Submit #798455 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_124/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda F456 httpd component, allowing remote attackers to trigger a denial of service or execute arbitrary code via the page parameter in /goform/L7Prot.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 may allow remote attackers to achieve remote code execution or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-7053

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-120) triggered within the frmL7ProtForm function of the httpd service. An attacker with low-level access can send a crafted POST request to the /goform/L7Prot endpoint containing an overly long page parameter to corrupt memory.

Business Impact

The exploitation of this vulnerability poses a severe risk to network integrity and availability. Successful execution allows for unauthorized remote code execution, which could lead to full device compromise, data exfiltration, or the establishment of a persistent foothold in the local network. With a CVSS score of 8.8, this flaw represents a High severity risk that could result in significant operational downtime or the total loss of confidentiality and integrity for the affected device.

Remediation Plan

Immediate Action: As no official patch version is currently identified, users should restrict network access to the management interface of the Tenda F456 device. Ensure the device is not exposed to the public internet and limit access to trusted administrative subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/L7Prot endpoint. Additionally, watch for unexpected device reboots or service instability, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming HTTP requests that contain excessively long strings within the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up provided by the vulnerability reporter.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on the user-provided input before passing it to the sprintf function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating the affected hardware from untrusted networks and contact the vendor for information regarding a firmware update. Until a formal patch is released, the device should be considered high-risk and monitored closely for any signs of compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: i9
AFFECTED_VERSIONS: 1.0.0.5(2204)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359616","name":"VDB-359616 | Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359616/cti","name":"VDB-359616 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798479","name":"Submit #798479 | Tenda i9 V1.0.0.5(2204) Absolute Path Traversal","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_80/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Tenda i9 HTTP handler allows unauthenticated remote attackers to bypass security whitelists and access sensitive administrative resources.

Executive Summary:
A critical path traversal vulnerability in Tenda i9 firmware version 1.0.0.5(2204) allows unauthenticated remote attackers to bypass authentication and access sensitive administrative pages.

Vulnerability Details

CVE-ID: CVE-2026-7036

Affected Software: Tenda i9

Affected Versions: 1.0.0.5(2204)

Vulnerability: The vulnerability exists in the R7WebsSecurityHandler function of the HTTP server, which fails to properly validate URL paths after verifying whitelisted prefixes. By using directory traversal sequences, such as "../", an unauthenticated attacker can circumvent the whitelist and access restricted administrative files.

Business Impact

Successful exploitation grants an unauthenticated attacker direct access to administrative interfaces and sensitive system files. This exposure can lead to full device compromise, unauthorized configuration changes, or the exfiltration of sensitive network information, presenting a significant security risk to the integrity of the managed infrastructure. The CVSS score of 7.3 reflects the high impact of unauthorized access to critical administrative functions.

Remediation Plan

Immediate Action: Contact the vendor for available firmware updates and apply them immediately to the affected hardware. If no patch is currently available, restrict management interface access to trusted administrative networks only.

Proactive Monitoring: Monitor network traffic for HTTP requests containing directory traversal patterns, such as sequences of "../", directed at the device management interface. Review server access logs for requests to sensitive files that do not originate from authorized internal IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge security appliance configured to inspect and block HTTP requests containing directory traversal sequences. Ensure the device management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up by Li Tengzheng.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no user interaction or prior authentication to bypass the security gatekeeper.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate attention. Administrators must prioritize isolating the affected Tenda i9 devices from untrusted networks and coordinating with the vendor to obtain the necessary firmware updates to remediate this authentication bypass flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1202
AFFECTED_VERSIONS: 1.2.0.14
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359615","name":"VDB-359615 | Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359615/cti","name":"VDB-359615 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798477","name":"Submit #798477 | Tenda FH1202 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_20/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda FH1202 httpd component allows remote attackers to execute arbitrary code or trigger a denial of service via the GO parameter in the WrlclientSet function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14 poses a high risk of remote code execution or system denial of service for affected network devices.

Vulnerability Details

CVE-ID: CVE-2026-7035

Affected Software: Tenda FH1202

Affected Versions: 1.2.0.14

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the formWrlclientSet function of the httpd component. An attacker with low-level access can trigger the vulnerability by sending a maliciously crafted POST request to the /goform/WrlclientSet endpoint, specifically manipulating the GO argument, which lacks adequate length validation.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to achieve remote code execution, which could lead to unauthorized access to the local network, sensitive data interception, or a complete denial of service. The ability to execute arbitrary code on networking infrastructure is a severe threat that compromises the integrity of the entire connected environment.

Remediation Plan

Immediate Action: Since no vendor-supplied patch is currently available, administrators should immediately isolate affected Tenda FH1202 devices from public-facing interfaces to prevent remote exploitation.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlclientSet endpoint and review device logs for signs of service crashes or unexpected process restarts.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to known, trusted internal IP addresses only. A Web Application Firewall may be configured to drop POST requests containing excessively long payloads in the GO parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-provided input.

Analyst Recommendation

Given the severity of this remote code execution flaw and the public availability of a proof-of-concept, immediate mitigation is required. Organizations should treat these devices as high-risk assets and enforce network-level access restrictions until a formal firmware update is released and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1202
AFFECTED_VERSIONS: 1.2.0.14(408)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359614","name":"VDB-359614 | Tenda FH1202 httpd WrlExtraSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359614/cti","name":"VDB-359614 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798476","name":"Submit #798476 | Tenda FH1202 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_19/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda FH1202 web server component, allowing remote attackers to trigger memory corruption via the GO argument in the WrlExtraSet function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda FH1202 routers may allow remote attackers to achieve remote code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7034

Affected Software: Tenda FH1202

Affected Versions: 1.2.0.14(408)

Vulnerability: This vulnerability is a stack-based buffer overflow triggered by improper bounds checking within the WrlExtraSet function of the httpd service. By submitting a specially crafted long string to the GO parameter, an authenticated attacker can overwrite stack memory to execute arbitrary code or crash the device.

Business Impact

The potential for remote code execution on network infrastructure poses a severe threat to internal network integrity. Successful exploitation could lead to full device compromise, allowing attackers to intercept traffic, pivot into the local network, or render the router inoperable, resulting in significant service downtime. The CVSS score of 8.8 reflects the high severity of this impact.

Remediation Plan

Immediate Action: Since no official patch is currently listed, users should restrict administrative access to the web interface from untrusted networks and disable remote management features immediately. Contact Tenda support or check the official vendor website for firmware updates that address this buffer overflow.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/WrlExtraSet endpoint and watch for unexpected device reboots or performance degradation.

Compensating Controls: Implement access control lists (ACLs) on the network perimeter to restrict traffic to the router management interface to known, trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's technical write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists via the researcher's technical documentation, which provides the necessary parameters to trigger the overflow. The vulnerability is inherently exploitable due to the absence of length validation before the data is processed by the sprintf function.

Analyst Recommendation

Given the availability of public proof-of-concept code and the critical nature of a buffer overflow in router firmware, this vulnerability must be treated with high urgency. Administrators should isolate affected devices from public-facing exposure until a vendor-supplied firmware update is applied to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359613","name":"VDB-359613 | Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359613/cti","name":"VDB-359613 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798454","name":"Submit #798454 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_123/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the Tenda F456 router, specifically within the fromSafeClientFilter function, allowing remote attackers to trigger memory corruption.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 firmware, version 1.0.0.5, poses a severe risk of remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7033

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the fromSafeClientFilter function within the /goform/SafeClientFilter endpoint. An authenticated attacker can supply an overly long string to the menufacturer parameter, which is then concatenated without bounds checking, leading to a stack-based buffer overflow.

Business Impact

The potential for remote code execution represents a significant security risk, as it grants unauthorized actors control over network infrastructure. Given the CVSS score of 8.8, this vulnerability is classified as high severity, potentially leading to full system compromise, lateral movement within the network, or persistent denial of service. Such an event would severely impact business continuity and compromise the integrity of the local network environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators must restrict access to the device management interface and disable remote administration features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/SafeClientFilter endpoint, particularly those containing unusually large payloads in the menufacturer parameter.

Compensating Controls: Implement strict firewall rules to ensure the device management interface is only accessible from trusted internal management subnets rather than the public internet.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in the researcher's technical write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of length validation in the strcat function, making the device trivial to crash or compromise.

Analyst Recommendation

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Because Tenda has not yet released a patch, organizations utilizing the F456 router must prioritize network-level isolation of the device. Administrators should monitor for vendor firmware updates daily and apply them immediately upon release to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359612","name":"VDB-359612 | Tenda F456 SafeEmailFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359612/cti","name":"VDB-359612 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798453","name":"Submit #798453 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_122/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.507Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 SafeEmailFilter function allows remote authenticated attackers to achieve code execution or denial of service via a crafted page parameter.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, permits remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-7032

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow (CWE-120) triggered by the SafeEmailFilter function within the /goform/SafeEmailFilter endpoint. An authenticated attacker can exploit this by sending a specially crafted page parameter to the HTTP interface, which lacks sufficient length validation during memory operations.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for full system compromise. Successful exploitation allows an attacker to execute arbitrary code or force a denial of service, potentially leading to unauthorized access to internal network traffic, loss of router control, and significant operational disruption.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict management access to the router to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/SafeEmailFilter endpoint. Any signs of service instability or unexpected reboots should be investigated as potential exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or similar network security appliance to inspect inbound HTTP traffic for unusually long parameter strings in requests destined for the router management interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via a published researcher write-up at the referenced GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of bounds checking in the vulnerable function, which provides a straightforward path for memory corruption.

Analyst Recommendation

Given the high severity and the existence of a public proof-of-concept, users of the Tenda F456 should treat this vulnerability with extreme urgency. Until a vendor-supplied firmware update is released, prioritize isolating the management interface from all untrusted networks to prevent unauthorized access and exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359611","name":"VDB-359611 | Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359611/cti","name":"VDB-359611 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798452","name":"Submit #798452 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_121/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the page parameter in the fromSafeMacFilter function.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7031

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow occurring in the fromSafeMacFilter function within the /goform/SafeMacFilter endpoint. The vulnerability is triggered by sending a specially crafted, oversized value to the page parameter, which allows an attacker with low privileges to achieve remote code execution or trigger a denial of service.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. This facilitates unauthorized access to local network traffic, potential interception of sensitive data, or complete disruption of internet connectivity, leading to significant operational downtime. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security integrity.

Remediation Plan

Immediate Action: As no vendor patch is currently confirmed, administrators should immediately restrict access to the web management interface of affected devices to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for abnormal POST requests directed at the /goform/SafeMacFilter endpoint, particularly those containing excessively long string parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control lists to block or sanitize traffic directed at the router's management web interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's GitHub write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and published researcher findings, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-supplied input.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Organizations utilizing Tenda F456 hardware should prioritize isolating these devices from external network exposure until an official firmware update is released and verified. Failure to mitigate this risk leaves critical network infrastructure vulnerable to compromise by remote actors.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359610","name":"VDB-359610 | Tenda F456 RouteStatic fromRouteStatic buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359610/cti","name":"VDB-359610 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798451","name":"Submit #798451 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_120/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the page parameter in the fromRouteStatic function.

Executive Summary:
A buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7030

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow flaw located in the fromRouteStatic function within the /goform/RouteStatic endpoint. The vulnerability is triggered when the application fails to perform length validation on the user-provided page parameter, allowing an authenticated attacker to corrupt memory and potentially execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution, which could lead to full device compromise and unauthorized access to network traffic. Given the CVSS score of 8.8, the potential for significant disruption to business operations and the loss of data confidentiality is high. The ability to execute arbitrary code on network infrastructure devices creates a severe risk of persistent unauthorized access within the local environment.

Remediation Plan

Immediate Action: Contact the vendor for an official security patch or firmware update, as there is currently no publicly confirmed fix available for version 1.0.0.5.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed toward the /goform/RouteStatic endpoint, particularly those containing unusually long string inputs in the page parameter.

Compensating Controls: Implement access control lists on the management interface to restrict access to trusted administrative IP addresses only, and deploy a Web Application Firewall or intrusion prevention system to detect and block oversized HTTP payloads.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the research references.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking on the page parameter during the execution of the fromRouteStatic function.

Analyst Recommendation

Given the severity of this remote code execution vulnerability and the availability of a public proof-of-concept, users of the Tenda F456 device should prioritize securing their hardware. Until an official patch is released, administrators must isolate the device from external network exposure and restrict access to the web management interface to mitigate the risk of exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359609","name":"VDB-359609 | Tenda F456 addressNat fromaddressNat buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359609/cti","name":"VDB-359609 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798450","name":"Submit #798450 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_119/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the fromaddressNat function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7029

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow vulnerability triggered by improper length validation within the fromaddressNat function. An authenticated attacker can send a crafted POST request to the /goform/addressNat endpoint to corrupt memory and potentially execute arbitrary code on the device.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk, primarily due to the potential for total system compromise. Successful exploitation allows an attacker to gain full control over the network device, which can be leveraged for unauthorized data access, network interception, or persistent presence within the local area network.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor releases a firmware update.

Proactive Monitoring: Review web access logs for unusual POST requests directed at the /goform/addressNat endpoint, particularly those containing excessively long parameter strings in the mitInterface field.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) rule to drop HTTP requests containing abnormally large payloads targeted at the vulnerable management URI.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-provided input in the affected function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents an urgent threat to network integrity. Organizations utilizing the Tenda F456 should implement immediate network segmentation or restrictive access controls to mitigate exposure while awaiting an official firmware patch from the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359598","name":"VDB-359598 | Tenda F456 P2pListFilter fromP2pListFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359598/cti","name":"VDB-359598 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797473","name":"Submit #797473 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_118/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.523Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows authenticated attackers to potentially execute arbitrary code or cause a denial of service via the P2pListFilter function.

Executive Summary:
A critical stack-based buffer overflow in the Tenda F456 router, version 1.0.0.5, poses a significant risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7019

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromP2pListFilter function of the /goform/P2pListFilter endpoint. An authenticated attacker can trigger a stack-based buffer overflow by providing an excessively long string to the page parameter, as the application fails to perform adequate length validation before passing the input to the sprintf function.

Business Impact

Successful exploitation of this flaw allows an attacker to achieve remote code execution on the affected device, potentially leading to a full compromise of the router. Given the CVSS score of 8.8, this vulnerability is classified as High, indicating a severe risk to network integrity. Compromise of network infrastructure can facilitate lateral movement within the environment, data interception, and total loss of device control.

Remediation Plan

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict access to the web management interface and ensure that only trusted users have authenticated access to the device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/P2pListFilter endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall or network-level access control lists to prevent unauthorized or suspicious traffic from reaching the device management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability references.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it involves a classic memory corruption flaw in a widely used administrative function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS severity, this vulnerability presents a credible threat to the Tenda F456 router. Organizations should prioritize restricting administrative access to the device and monitor for any vendor announcements regarding a firmware update. Until a formal patch is released, the device should be considered at risk of compromise if exposed to untrusted network segments.

---METADATA---
VENDOR: Tenda
PRODUCT: HG10
AFFECTED_VERSIONS: HG7_HG9_HG10re_300001138_en_xpon
CONFIDENCE: high
MISSING: patch
CREDITS: xuanyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359540","name":"VDB-359540 | Tenda HG10 Boa Service formRouting formRoute buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359540/cti","name":"VDB-359540 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/796427","name":"Submit #796427 | Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/xyh4ck/iot_poc/blob/main/Tenda/HG10/01_Buffer_Overflow_nextHop/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda HG10 web management interface allows unauthenticated remote attackers to crash the device or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow in Tenda HG10 firmware enables unauthenticated remote attackers to trigger a denial of service or potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6988

Affected Software: Tenda HG10

Affected Versions: HG7_HG9_HG10re_300001138_en_xpon

Vulnerability: The Boa web service fails to perform boundary checks on the nextHop parameter within the formRoute function, leading to a stack-based buffer overflow that can be triggered by an unauthenticated attacker via a crafted HTTP POST request.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service of the affected router, disrupting critical network connectivity for all connected users and systems. Furthermore, because the Boa process operates with root privileges on the device, there is a significant risk that an attacker could leverage this memory corruption to achieve remote code execution, granting full control over the networking hardware. Given the CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately isolate the management interface from the public internet and restrict access to trusted management networks only.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP POST requests directed at the /boaform/formRouting endpoint, specifically looking for abnormally long payloads in the nextHop parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and drop HTTP requests containing excessive data within the nextHop parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers as it requires no authentication and targets a standard web management endpoint.

Analyst Recommendation

Due to the ease of exploitation and the potential for full system compromise, this vulnerability must be treated with high urgency. Organizations utilizing Tenda HG10 devices must ensure the web management interface is not exposed to the internet. Monitor vendor communication channels closely for the release of an official firmware update and apply it immediately upon availability.

---METADATA---
VENDOR: Tenda
PRODUCT: W6-S
AFFECTED_VERSIONS: 1.0.0.4(510)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda W6-S web interface allows remote, unauthenticated attackers to trigger a crash or execute arbitrary code via the wifiSSIDset endpoint.

Executive Summary:
The Tenda W6-S wireless access point is vulnerable to a critical stack-based buffer overflow that may allow remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-67822

Affected Software: Tenda W6-S

Affected Versions: 1.0.0.4(510)

Vulnerability: The vulnerability exists in the formwrlSSIDset function, which uses the unsafe sprintf function to copy user-supplied 'GO' and 'index' parameters into a fixed-size 64-byte stack buffer. This allows an unauthenticated attacker to overwrite the stack, potentially leading to arbitrary code execution.

Business Impact

Exploitation of this buffer overflow could lead to a full device takeover or permanent denial of service. Because the device is a network infrastructure component, successful compromise could facilitate man-in-the-middle attacks or provide a persistent foothold within the local network, justifying the critical 9.8 CVSS score.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, isolate the management interface of affected devices from the public internet and untrusted networks.

Proactive Monitoring: Monitor network traffic for malformed HTTP requests directed at the /goform/wifiSSIDset endpoint.

Compensating Controls: Restrict access to the device management interface to a dedicated, secure management VLAN and implement strict source IP filtering.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of July 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly susceptible to exploitation due to the lack of bounds checking.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the lack of a vendor-provided patch, immediate network segmentation is required. Administrators should restrict management access to the affected Tenda devices until a firmware update addressing the buffer overflow is released.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: jimi666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/358266","name":"VDB-358266 | Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/358266/cti","name":"VDB-358266 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792905","name":"Submit #792905 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/26","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.623Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F451 httpd component allows remote attackers to trigger memory corruption via the menufacturer/Go argument.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F451 allows for remote memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6632

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This is a memory corruption flaw (CWE-120) triggered by improper input validation in the fromSafeClientFilter function within the /goform/SafeClientFilter endpoint. The vulnerability can be triggered by a remote attacker with low-level privileges by sending a crafted request to the menufacturer/Go argument.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system impact. Successful exploitation could lead to unauthorized code execution or service disruption, potentially exposing internal network segments or causing significant downtime for critical infrastructure relying on this hardware.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the device management interface to trusted IPs only and disable remote access features.

Proactive Monitoring: Monitor device traffic and system logs for unexpected behavior or repeated access attempts targeting the /goform/SafeClientFilter endpoint.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system to filter out requests containing malicious payloads in the menufacturer/Go parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on the Jimi-Lab GitHub repository.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier for attackers to weaponize this memory corruption flaw.

Analyst Recommendation

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability poses a significant risk to affected Tenda F451 devices. Administrators must implement network-level access controls immediately to prevent remote exploitation, as a vendor patch is not currently available. Continued monitoring for firmware updates from Tenda is essential to address this memory corruption vulnerability at the root level.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: jimi666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/358265","name":"VDB-358265 | Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/358265/cti","name":"VDB-358265 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792904","name":"Submit #792904 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/25","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.623Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the Tenda F451 web interface, allowing remote attackers to potentially execute arbitrary code by manipulating the page argument.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda F451 router allows remote, authenticated attackers to achieve total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6631

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: The vulnerability exists within the webExcptypemanFilter function of the httpd component. By sending a crafted request with a manipulated page argument, a remote authenticated attacker can trigger a buffer overflow, leading to memory corruption.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, potentially allowing an attacker to gain unauthorized control over the network device. Given the CVSS score of 8.8, this poses a high risk of lateral movement within the network, data interception, or service disruption, which can severely impact business operations and overall network security posture.

Remediation Plan

Immediate Action: Since a specific patch version is not currently available, administrators should restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor device logs for unusual traffic patterns or errors originating from the /goform/webExcptypemanFilter endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement network-level access control lists to block unauthorized access to the device management interface.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub issue reported by Jimi-Lab.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the nature of buffer overflows in low-level system components.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity and availability of the Tenda F451 router. While a vendor patch is currently not confirmed, organizations must isolate the device management interface from untrusted networks immediately. Security teams should prioritize monitoring for anomalous activity and apply official firmware updates as soon as they are released by the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/358264","name":"VDB-358264 | Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/358264/cti","name":"VDB-358264 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792882","name":"Submit #792882 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/23","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.627Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F451 web interface allows remote attackers to trigger memory corruption via the dips argument in the fromGstDhcpSetSer function.

Executive Summary:
A critical memory corruption vulnerability in Tenda F451 routers enables remote attackers to trigger a buffer overflow, posing a significant risk to device integrity and network security.

Vulnerability Details

CVE-ID: CVE-2026-6630

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This issue is a buffer overflow (CWE-120) triggered by improper memory handling within the fromGstDhcpSetSer function of the httpd service. While the CVSS vector indicates low privileges are required, the vulnerability is remotely exploitable and leads to total compromise of the affected component.

Business Impact

The exploitation of this buffer overflow allows for arbitrary code execution or a denial of service, potentially resulting in full device takeover. Given the CVSS score of 8.8, this vulnerability presents a high risk to organizational infrastructure by allowing attackers to intercept traffic or gain unauthorized access to the internal network.

Remediation Plan

Immediate Action: Contact Tenda support or monitor the official vendor portal for firmware updates, as no official patch is currently identified for this specific version.

Proactive Monitoring: Inspect network logs for unusual traffic directed at the /goform/GstDhcpSetSer endpoint and monitor for unexpected router reboots or service instability.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses and employ a WAF or firewall rule to filter malicious payloads from incoming HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up at the referenced GitHub repository.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected argument.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the high severity of the memory corruption flaw, immediate attention is required. Administrators should isolate the affected Tenda F451 devices from the public internet until a vendor-supplied firmware update is verified and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357122","name":"VDB-357122 | Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357122/cti","name":"VDB-357122 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797472","name":"Submit #797472 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_117/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
Tenda F456 version 1.0.0.5 is vulnerable to a stack-based buffer overflow in the webtypelibrary function, which may allow remote code execution via a specially crafted request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F456 router enables remote code execution and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6200

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the formWebTypeLibrary function within the /goform/webtypelibrary endpoint. An authenticated attacker can trigger the overflow by supplying an overly long webSiteId parameter, which is processed without proper length validation.

Business Impact

The ability for an attacker to achieve remote code execution on network infrastructure poses a severe risk to organizational security. Successful exploitation could lead to full device compromise, potential lateral movement into the internal network, and significant disruption of internet connectivity, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the web management interface of the Tenda F456 to trusted management subnets only.

Proactive Monitoring: Monitor device traffic for anomalous POST requests directed at the /goform/webtypelibrary endpoint, particularly those containing excessively large parameter strings.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to block or truncate long input strings sent to router administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-supplied input.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant risk to the integrity of the Tenda F456 device. Administrators must prioritize limiting access to the management interface until the vendor releases a firmware update that addresses the underlying buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357121","name":"VDB-357121 | Tenda F456 qossetting fromqossetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357121/cti","name":"VDB-357121 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797471","name":"Submit #797471 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_116/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in Tenda F456 version 1.0.0.5, allowing remote attackers to trigger memory corruption via the page parameter in the /goform/qossetting endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 allows remote attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-6199

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The flaw resides in the fromqossetting function within the /goform/qossetting endpoint, where the page parameter is processed by a sprintf function without sufficient length validation. While the CVSS vector indicates low privilege requirements, the vulnerability is remotely exploitable and leads to memory corruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it enables remote code execution or persistent denial of service on network hardware. With a CVSS score of 8.8, this high-severity flaw could lead to full device compromise, allowing attackers to intercept traffic or pivot into internal network segments.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface of the affected Tenda F456 devices.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /goform/qossetting URI, specifically looking for abnormally long string patterns in the page parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network inspection rule to block requests containing malformed or excessively long arguments directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the severity of this vulnerability and the availability of public proof-of-concept code, immediate action is required to prevent compromise. Organizations using the affected Tenda F456 hardware should isolate these devices from the public internet and restrict management access to trusted internal addresses until a vendor-supplied firmware update is deployed.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357120","name":"VDB-357120 | Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357120/cti","name":"VDB-357120 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797470","name":"Submit #797470 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_115/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in Tenda F456 version 1.0.0.5 within the fromNatStaticSetting function, allowing remote attackers to trigger memory corruption via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 routers enables remote code execution or denial of service attacks against affected devices.

Vulnerability Details

CVE-ID: CVE-2026-6198

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the /goform/NatStaticSetting endpoint, where the application fails to perform adequate length validation on the page parameter before passing it to the sprintf function. This flaw allows an authenticated user to overwrite the stack, potentially leading to remote code execution or system instability.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network security. By triggering a buffer overflow, an attacker can gain unauthorized control over the router, potentially intercepting traffic, modifying network configurations, or launching further attacks within the internal network. Given the CVSS score of 8.8, this vulnerability is categorized as High severity and requires immediate attention to prevent device compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/NatStaticSetting endpoint and audit device logs for unexpected reboots or crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to block requests containing excessively long payloads in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher write-up provided by Litengzheng.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected function.

Analyst Recommendation

Due to the remote nature of this vulnerability and the availability of a public proof-of-concept, the risk to Tenda F456 devices is significant. Organizations using these devices must prioritize hardening the management interface and implementing strict network access controls. If firmware updates become available from Tenda, they should be applied as a matter of urgency to permanently resolve the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357119","name":"VDB-357119 | Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357119/cti","name":"VDB-357119 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797468","name":"Submit #797468 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_114/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F456 web interface allows remote attackers to trigger memory corruption and potential code execution via a crafted mit_ssid parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 routers poses a significant risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-6197

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability occurs in the formWrlsafeset function within the /goform/AdvSetWrlsafeset endpoint, where the mit_ssid parameter is processed without adequate length validation. This memory corruption flaw can be triggered by an authenticated user to overwrite the stack, potentially leading to denial of service or remote code execution.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the affected network device, which may lead to complete compromise of local network traffic or permanent denial of service. Given the high CVSS score of 8.8, this flaw represents a severe threat to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Contact the vendor for firmware updates, as no official patch is currently identified for this specific version. If no update is available, restrict management interface access to trusted administrative networks only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/AdvSetWrlsafeset endpoint and watch for abnormal system reboots or service crashes.

Compensating Controls: Implement strict network access control lists to prevent unauthorized users from reaching the administrative web interface of the router.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the target function.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly lowers the barrier for exploitation. Organizations utilizing Tenda F456 hardware must treat this vulnerability with high urgency, isolating vulnerable devices from the public internet until a vendor-supplied patch is applied.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357118","name":"VDB-357118 | Tenda F456 exeCommand fromexeCommand stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357118/cti","name":"VDB-357118 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797467","name":"Submit #797467 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_113/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F456 /goform/exeCommand function allows remote attackers to execute code or cause a denial of service via the cmdinput parameter.

Executive Summary:
A critical remote code execution vulnerability in Tenda F456 routers poses a severe risk of system compromise due to a stack-based buffer overflow.

Vulnerability Details

CVE-ID: CVE-2026-6196

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The device is vulnerable to a stack-based buffer overflow in the fromexeCommand function within the /goform/exeCommand endpoint. An authenticated attacker can trigger this memory corruption by sending a crafted cmdinput parameter, as the application fails to perform necessary length checks before copying the input into a fixed-size stack buffer.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected hardware, potentially leading to a full system takeover, unauthorized network access, or permanent denial of service. With a CVSS score of 8.8, this flaw represents a High severity risk that could disrupt critical infrastructure or expose sensitive data traversing the network, necessitating immediate attention from security teams.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface of the Tenda F456, ensuring it is not reachable from untrusted networks or the public internet.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/exeCommand endpoint and review device logs for signs of unexpected crashes or service restarts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with custom rules to inspect and drop HTTP requests containing abnormally long strings in the cmdinput parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a security research write-up hosted on GitHub.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it involves a lack of bounds checking on a user-controlled input, which is a classic vector for memory corruption attacks.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of the potential impact, organizations utilizing Tenda F456 devices must prioritize the isolation of these units. While a vendor patch is awaited, enforcing strict network segmentation and disabling remote management access is the most effective strategy to mitigate the risk of remote exploitation. Monitor vendor communication channels closely for the release of a firmware update that addresses the memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357001","name":"VDB-357001 | Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357001/cti","name":"VDB-357001 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792881","name":"Submit #792881 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/22","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 router allows remote attackers to trigger memory corruption via the wanmode or PPPOEPassword arguments in the fromAdvSetWan function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F451 router allows remote, authenticated attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-6137

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the fromAdvSetWan function of the /goform/AdvSetWan endpoint. The vulnerability is triggered by sending malicious input to the wanmode or PPPOEPassword arguments, requiring at least low-level authenticated access to the device.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high potential for severe impact on organizational infrastructure. Successful exploitation allows for remote code execution, which could lead to full device compromise, loss of network control, and lateral movement into the internal network environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for unusual payloads directed at the /goform/AdvSetWan endpoint and review system logs for recurring service crashes or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion detection system to filter or block requests containing excessively long strings in the wanmode or PPPOEPassword fields.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Jimi-Lab/cve repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the existence of a public proof-of-concept, exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ability to bypass standard memory protections through direct manipulation of the stack.

Analyst Recommendation

Given the high severity of this memory corruption vulnerability and the availability of a public proof-of-concept, immediate defensive action is required. Organizations using the Tenda F451 should prioritize isolating the management interface from the public internet and await official remediation from the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357000","name":"VDB-357000 | Tenda F451 L7Im frmL7ImForm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357000/cti","name":"VDB-357000 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792880","name":"Submit #792880 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/21","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
The Tenda F451 router contains a stack-based buffer overflow in the frmL7ImForm function due to improper handling of the page argument, allowing for potential remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F451 router allows remote attackers to compromise system integrity via the L7Im form.

Vulnerability Details

CVE-ID: CVE-2026-6136

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) triggered by manipulating the page argument within the frmL7ImForm function of the /goform/L7Im endpoint. The attack can be initiated remotely by an authenticated user.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk that could lead to full system compromise. Successful exploitation allows for unauthorized code execution, which may result in a total loss of confidentiality, integrity, and availability of the affected network device.

Remediation Plan

Immediate Action: Contact Tenda support or check the official website for firmware updates addressing this buffer overflow, as no specific patch version is currently identified.

Proactive Monitoring: Monitor network traffic for anomalous requests directed at the /goform/L7Im endpoint and review router logs for signs of unauthorized access or service crashes.

Compensating Controls: Implement strict access control lists on the management interface and place the device behind a firewall to restrict access to the web administration panel from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up at the referenced GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ability to facilitate remote memory corruption.

Analyst Recommendation

Given the presence of a public proof-of-concept and the high CVSS score, this vulnerability poses a significant risk to affected environments. Administrators should prioritize restricting network access to the device management interface immediately until a formal vendor patch can be applied.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356999","name":"VDB-356999 | Tenda F451 SetIpBind fromSetIpBind stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356999/cti","name":"VDB-356999 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792877","name":"Submit #792877 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/19","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 SetIpBind function allows remote attackers to trigger memory corruption via the page argument.

Executive Summary:
A remote stack-based buffer overflow in Tenda F451 allows for potential system compromise, requiring immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6135

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) located in the SetIpBind function within the /goform/SetIpBind endpoint. The flaw can be triggered remotely by manipulating the page argument, requiring low privileges to execute.

Business Impact

The vulnerability poses a severe risk to business operations, as successful exploitation results in memory corruption that may lead to arbitrary code execution or a complete denial of service. With a CVSS score of 8.8, this flaw is considered high severity, potentially leading to unauthorized system access or the total loss of device availability.

Remediation Plan

Immediate Action: Contact Tenda for the latest firmware updates or security patches for the F451 device, as there is currently no publicly confirmed patch available.

Proactive Monitoring: Review device access logs for unusual traffic patterns directed toward the /goform/SetIpBind endpoint.

Compensating Controls: Implement network segmentation to restrict access to the device management interface and deploy a Web Application Firewall to filter malicious input payloads targeting the affected parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced security research.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, and a functional exploit has been publicly disclosed via the Jimi-Lab GitHub repository, so exploitation risk should be treated as credible. The nature of this memory corruption flaw makes it a prime target for remote attackers.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, users should prioritize securing these devices immediately. If a firmware update from Tenda is not available, isolate the affected hardware from the public internet to prevent remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: Tenda F451: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356998","name":"VDB-356998 | Tenda F451 qossetting fromqossetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356998/cti","name":"VDB-356998 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792876","name":"Submit #792876 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/18","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda F451 router due to improper input validation in the qos parameter of the /goform/qossetting function, which can be exploited remotely by an attacker.

Executive Summary:
A remote stack-based buffer overflow vulnerability in Tenda F451 routers poses a severe risk of arbitrary code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-6134

Affected Software: Tenda F451

Affected Versions: Tenda F451: 1.0.0.7_cn_svn7958

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the /goform/qossetting file within the fromqossetting function. An attacker with low-level privileges can trigger this memory corruption by manipulating the qos argument.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its high impact on system integrity, availability, and confidentiality. Successful exploitation allows an attacker to execute arbitrary code or cause a device crash, potentially leading to unauthorized network access, data interception, or a complete denial of service for the managed network environment.

Remediation Plan

Immediate Action: Since a specific patch version is not currently provided, isolate the affected Tenda F451 devices from external network access until the manufacturer releases a firmware update.

Proactive Monitoring: Monitor device traffic for anomalous HTTP POST requests directed at the /goform/qossetting endpoint, specifically looking for unusually large or malformed payloads in the qos parameter.

Compensating Controls: Implement strict access control lists on the management interface to ensure that only authorized administrative IP addresses can communicate with the router, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub issue referenced in the vulnerability report (https://github.com/Jimi-Lab/cve/issues/18).

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild, but the availability of a public proof-of-concept makes the risk of exploitation credible. The nature of this memory corruption flaw allows for potential remote code execution, which is a significant concern for edge networking devices.

Analyst Recommendation

Given the high severity and the availability of public proof-of-concept code, organizations utilizing Tenda F451 routers should treat this as a high-priority risk. Immediately restrict access to the device management interface to trusted internal networks and monitor vendor support channels for the release of a patched firmware version.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7_cn_svn7958
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356997","name":"VDB-356997 | Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356997/cti","name":"VDB-356997 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792875","name":"Submit #792875 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/17","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
The Tenda F451 router is vulnerable to a remote stack-based buffer overflow via the fromSafeUrlFilter function, allowing potential memory corruption through the page argument.

Executive Summary:
A remote stack-based buffer overflow vulnerability in the Tenda F451 router exposes the device to potential memory corruption and unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-6133

Affected Software: Tenda F451

Affected Versions: 1.0.0.7_cn_svn7958

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. The flaw is triggered by manipulating the page argument, which can be executed remotely by an authenticated user.

Business Impact

The exploitation of this vulnerability can lead to a complete compromise of the affected router, resulting in unauthorized access to network traffic or system instability. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate lateral movement within the network or persistent denial of service.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management interface access to trusted IP addresses only and monitor for any unusual traffic patterns.

Proactive Monitoring: Security teams should review firewall and system logs for unexpected requests directed at the /goform/SafeUrlFilter endpoint, particularly those containing abnormally long strings in the page parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-based intrusion detection system to filter and block malicious requests targeting the vulnerable URL parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub issue.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous as it allows for memory corruption via a reachable network-facing endpoint.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability poses a significant risk to network integrity. Organizations utilizing the affected Tenda hardware must prioritize hardening the management interface and applying any vendor-supplied firmware updates as soon as they become available to neutralize this threat.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356987","name":"VDB-356987 | Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356987/cti","name":"VDB-356987 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792874","name":"Submit #792874 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/16","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.863Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 router allows remote attackers to trigger memory corruption via the page/menufacturer argument in the fromSafeMacFilter function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F451 routers enables remote attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-6124

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: The vulnerability exists in the fromSafeMacFilter function within the httpd component. An attacker can trigger a stack-based buffer overflow by manipulating the page/menufacturer argument, which is accessible to authenticated users.

Business Impact

The exploitation of this memory corruption vulnerability can result in full system compromise, including unauthorized access to network traffic or persistent denial of service. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of the affected network infrastructure. Organizations failing to secure these devices risk lateral movement by attackers into internal network segments.

Remediation Plan

Immediate Action: Contact the vendor for firmware updates or, if no patch is available, isolate the device from the public internet immediately.

Proactive Monitoring: Review web server logs for irregular input strings directed at the /goform/SafeMacFilter endpoint and monitor for unexpected device reboots.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of the Tenda F451 to trusted management IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its location in the httpd daemon, which typically runs with elevated privileges.

Analyst Recommendation

Given the high CVSS severity and the existence of a public proof-of-concept, users must treat this vulnerability with extreme urgency. Administrators should restrict management access to the device immediately and prioritize firmware updates as soon as they are released by Tenda to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356986","name":"VDB-356986 | Tenda F451 httpd addressNat fromAddressNat stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356986/cti","name":"VDB-356986 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792873","name":"Submit #792873 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/792879","name":"Submit #792879 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow (Duplicate)","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/15","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.863Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 httpd component allows remote attackers to trigger memory corruption via the fromAddressNat function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F451 router allows remote attackers to achieve arbitrary memory corruption, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6123

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the fromAddressNat function of the httpd component. It is triggered by manipulating the entrys argument, and the CVSS vector indicates that a remote, authenticated attacker can cause memory corruption.

Business Impact

Successful exploitation of this buffer overflow could lead to a complete compromise of the affected router, potentially allowing an attacker to gain unauthorized control over network traffic or disrupt critical business communication. With a CVSS score of 8.8, this flaw represents a high risk to infrastructure integrity and data confidentiality, necessitating immediate attention to prevent unauthorized access to the local network.

Remediation Plan

Immediate Action: As no specific patch version is currently listed by the vendor, users should restrict access to the web management interface to trusted internal segments only and monitor for anomalous traffic patterns.

Proactive Monitoring: Security teams should review device access logs for unusual requests directed at the /goform/addressNat endpoint and monitor for unexpected service restarts.

Compensating Controls: Deploying a network-based intrusion detection system or configuring firewall rules to block unauthorized external access to the device management interface can mitigate the risk of remote exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at the Jimi-Lab GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of stack-based buffer overflows, which can often be weaponized for remote code execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of the memory corruption flaw, administrators must treat this as a priority. Immediately isolate the management interface of the affected Tenda F451 devices from public-facing networks and maintain close contact with the vendor for the release of an official firmware security update.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jxm666 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356985","name":"VDB-356985 | Tenda F451 httpd L7Prot frmL7ProtForm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356985/cti","name":"VDB-356985 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792872","name":"Submit #792872 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/14","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.879Z
---END_METADATA---

Description Summary:
The Tenda F451 router is vulnerable to a stack-based buffer overflow in the httpd component, allowing remote attackers to trigger memory corruption via the page argument in /goform/L7Prot.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F451 router enables remote code execution and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6122

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: The vulnerability exists within the frmL7ProtForm function of the httpd component. An attacker with low-level privileges can trigger a stack-based buffer overflow by manipulating the page argument, leading to potential memory corruption.

Business Impact

This vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation could allow a remote attacker to crash the affected device, potentially causing a denial of service, or execute arbitrary code, leading to complete compromise of the network gateway and unauthorized access to internal traffic.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/L7Prot endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to filter and block malformed requests containing excessive data in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the research write-up at the Jimi-Lab GitHub repository.

Analyst Notes: As of April 13, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists as documented in the linked technical disclosure. Given the nature of buffer overflows in embedded web servers, this vulnerability is inherently highly exploitable.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, the risk to Tenda F451 users is significant. Administrators must isolate the device management interface from external access immediately and monitor for any vendor-released firmware updates to address the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356984","name":"VDB-356984 | Tenda F451 httpd WrlclientSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356984/cti","name":"VDB-356984 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792865","name":"Submit #792865 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/12","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.879Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 httpd component allows remote attackers to trigger memory corruption via the GO argument in the WrlclientSet function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F451 allows remote attackers to achieve unauthorized control over the device, posing a significant risk of compromise.

Vulnerability Details

CVE-ID: CVE-2026-6121

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) within the WrlclientSet function of the httpd component. An attacker with low-level privileges can send a crafted request to the /goform/WrlclientSet endpoint to trigger memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system impact. Successful exploitation allows an attacker to execute arbitrary code or cause a denial of service, potentially leading to unauthorized network access, data exfiltration, or complete loss of control over the networking hardware.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, restrict access to the device management interface to trusted internal networks only. Contact Tenda support or monitor their official website for firmware updates addressing this buffer overflow.

Proactive Monitoring: Review device access logs for unusual traffic patterns directed at the /goform/WrlclientSet endpoint. Monitor system stability for unexpected reboots or service crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to inspect and block malicious payloads targeting the specific vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research findings documented at https://github.com/Jimi-Lab/cve/issues/12.

Analyst Notes: As of April 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease of reaching the vulnerable function remotely.

Analyst Recommendation

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability should be treated with urgency. Administrators must prioritize isolating the affected Tenda F451 units from public-facing internet access until a vendor-supplied firmware patch is verified and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: Tenda F451: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356983","name":"VDB-356983 | Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356983/cti","name":"VDB-356983 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792864","name":"Submit #792864 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/11","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.879Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the fromDhcpListClient function of the Tenda F451 router allows remote attackers to trigger memory corruption via the page argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F451 routers enables remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-6120

Affected Software: Tenda F451

Affected Versions: Tenda F451: 1.0.0.7

Vulnerability: The flaw resides in the fromDhcpListClient function within the httpd component and is triggered by a crafted page argument. An attacker with low privileges can remotely execute this stack-based buffer overflow, leading to potential memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a total compromise of the affected router, potentially allowing an attacker to intercept traffic, pivot into internal network segments, or render the device unusable. Given the CVSS score of 8.8, this represents a high-severity threat that could result in significant operational disruption and data exposure within the affected environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the web management interface and monitor for suspicious traffic directed at the /goform/DhcpListClient endpoint.

Proactive Monitoring: Review system logs for signs of unauthorized access or abnormal crash patterns in the httpd service that might indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the router's web management interface from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of April 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of stack-based buffer overflows in network appliances often allows for reliable remote code execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a credible and significant risk. Organizations utilizing Tenda F451 hardware should prioritize isolating these devices from the public internet and contact the vendor immediately for firmware update guidance.

---METADATA---
VENDOR: Tenda
PRODUCT: AC9
AFFECTED_VERSIONS: Tenda AC9: 15.03.02.13
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356572","name":"VDB-356572 | Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356572/cti","name":"VDB-356572 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791829","name":"Submit #791829 | Tenda AC9 AC9 V1.0 V15.03.02.13 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC9-WizardHandle-33153a41781f808480f9e3b78ce438e0?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC9 router allows remote attackers to trigger memory corruption via a crafted POST request to the WizardHandle endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC9 routers allows remote, authenticated attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-6016

Affected Software: Tenda AC9

Affected Versions: Tenda AC9: 15.03.02.13

Vulnerability: The flaw exists in the decodePwd function within the /goform/WizardHandle file, which processes POST requests. An attacker with low-level privileges can trigger a stack-based buffer overflow by manipulating the WANS argument.

Business Impact

This vulnerability poses a significant risk to network integrity and confidentiality, as successful exploitation could lead to full system compromise or persistent denial of service. With a CVSS score of 8.8, the impact is severe, potentially allowing an attacker to intercept traffic or gain administrative control over the network infrastructure.

Remediation Plan

Immediate Action: Since a specific patch is not currently confirmed, users should restrict access to the web management interface to trusted internal segments and disable the WizardHandle functionality if possible.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WizardHandle endpoint and watch for unexpected router reboots or service instability.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion detection system to filter and block malicious traffic containing abnormally long inputs in the WANS parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of memory via a standard web interface parameter.

Analyst Recommendation

Given the presence of a public proof-of-concept and the high CVSS severity, this vulnerability presents a credible risk to Tenda AC9 deployments. Administrators must prioritize isolating affected devices from external exposure and monitor vendor communication channels for the release of a firmware update to permanently remediate the buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: AC9
AFFECTED_VERSIONS: 15.03.02.13
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356571","name":"VDB-356571 | Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356571/cti","name":"VDB-356571 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791828","name":"Submit #791828 | Tenda AC9 AC9 V1.0 V15.03.02.13 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC9-QuickIndex-33153a41781f80458940f212f150a4fb?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC9 router allows remote attackers to trigger memory corruption via a crafted PPPOEPassword argument in the formQuickIndex function.

Executive Summary:
A critical remote code execution vulnerability in Tenda AC9 routers allows attackers to trigger a stack-based buffer overflow via an unauthenticated or low-privilege network request.

Vulnerability Details

CVE-ID: CVE-2026-6015

Affected Software: Tenda AC9

Affected Versions: 15.03.02.13

Vulnerability: This vulnerability consists of a stack-based buffer overflow within the formQuickIndex function of the /goform/QuickIndex endpoint. By sending a crafted POST request containing a malicious PPPOEPassword argument, an attacker can corrupt memory on the device.

Business Impact

The exploitation of this vulnerability can lead to a complete compromise of the affected router, resulting in unauthorized network access, data interception, or the potential for further lateral movement within the local network. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security, particularly for remote or branch office environments relying on this hardware.

Remediation Plan

Immediate Action: Since a vendor-provided patch is currently unknown, users should restrict administrative access to the router interface and ensure it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/QuickIndex endpoint, which may indicate attempted exploitation.

Compensating Controls: Implement firewall rules to block unsolicited inbound traffic to the management interface of the Tenda AC9 device.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up referenced in the vulnerability disclosure.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published technical write-up detailing the exploitation mechanism increases the likelihood of successful attacks by malicious actors.

Analyst Recommendation

Organizations utilizing Tenda AC9 hardware must treat this vulnerability with high urgency due to the availability of public proof-of-concept code. Administrators should immediately isolate the device from external network exposure and monitor the vendor's official support channels for the release of a firmware update to address this buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356546","name":"VDB-356546 | Tenda F451 P2pListFilter fromP2pListFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356546/cti","name":"VDB-356546 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792863","name":"Submit #792863 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/10","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda F451 version 1.0.0.7 allows remote attackers to trigger memory corruption via the page argument in the fromP2pListFilter function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F451 routers could allow remote attackers to achieve unauthorized code execution or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-5992

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: The device is susceptible to a stack-based buffer overflow triggered via the page argument within the fromP2pListFilter function in the /goform/P2pListFilter endpoint. This vulnerability requires low privileges (authenticated) to execute, as indicated by the CVSS vector.

Business Impact

The exploitation of this buffer overflow can lead to a full compromise of the affected router, resulting in potential unauthorized access to the network or complete device failure. Given the CVSS score of 8.8, this flaw represents a high risk to business continuity and internal network integrity, as it allows an attacker to manipulate core device memory.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict network access to the management interface and verify if the vendor provides firmware updates via their official website.

Proactive Monitoring: Monitor device logs for anomalous traffic patterns directed at the /goform/P2pListFilter endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement strict firewall rules to ensure that only authorized administrative IP addresses can access the router management interface, effectively mitigating remote exploitation vectors.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of stack-based buffer overflows in network-facing components.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of memory corruption vulnerabilities, this issue poses a significant risk to affected environments. Organizations should prioritize isolating the affected hardware from external network exposure and monitor the vendor support portal for the release of a security patch to address this buffer overflow definitively.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356545","name":"VDB-356545 | Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356545/cti","name":"VDB-356545 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792862","name":"Submit #792862 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/9","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
Tenda F451 version 1.0.0.7 is vulnerable to a stack-based buffer overflow in the formWrlExtraSet function, which can be triggered remotely via the GO argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F451 routers allows remote attackers to execute code via malicious input, posing a significant threat to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-5991

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the formWrlExtraSet function of the /goform/WrlExtraSet endpoint. An authenticated attacker can trigger this memory corruption by manipulating the GO argument, potentially leading to arbitrary code execution.

Business Impact

Successful exploitation of this buffer overflow could lead to a complete loss of control over the affected network device. Given the CVSS score of 8.8, the business impact includes the potential for unauthorized network access, interception of sensitive traffic, and total device compromise, which may result in significant operational downtime or lateral movement within the network.

Remediation Plan

Immediate Action: Check the official Tenda support portal for firmware updates addressing this vulnerability and apply them immediately to all affected F451 units.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlExtraSet endpoint and inspect device logs for unexpected reboots or crash events.

Compensating Controls: Restrict management access to the device to a trusted management network or VPN, and utilize a firewall to block unauthorized access to the web interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical report provided by the vulnerability researcher at the referenced GitHub repository.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of stack-based buffer overflows in network-facing interface functions.

Analyst Recommendation

Due to the severity of this memory corruption vulnerability and the availability of a public proof-of-concept, users must prioritize the deployment of vendor security updates. If a patch is not currently available for your specific deployment, strict network segmentation is required to prevent remote access to the vulnerable administrative interface.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356544","name":"VDB-356544 | Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356544/cti","name":"VDB-356544 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792861","name":"Submit #792861 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/8","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 function fromSafeEmailFilter allows remote attackers to trigger memory corruption via the page argument.

Executive Summary:
A critical stack-based buffer overflow in Tenda F451 allows remote code execution, posing a significant risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5990

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: This vulnerability is a stack-based buffer overflow located in the fromSafeEmailFilter function within the /goform/SafeEmailFilter file. An authenticated attacker can trigger the overflow by manipulating the page argument, leading to potential memory corruption or remote code execution.

Business Impact

The exploitation of this vulnerability could lead to total loss of system integrity and availability, as the buffer overflow allows for arbitrary code execution. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could be leveraged to gain unauthorized control over network infrastructure, potentially facilitating lateral movement within the environment.

Remediation Plan

Immediate Action: Contact Tenda support or monitor the official Tenda website for the release of a firmware update that addresses the buffer overflow in the SafeEmailFilter component.

Proactive Monitoring: Review device access logs for unusual traffic patterns directed at the /goform/SafeEmailFilter endpoint, specifically monitoring for abnormally long strings in the page parameter.

Compensating Controls: Implement strict network access control lists to limit management interface access to trusted internal IP addresses, thereby reducing the attack surface for remote exploitation.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up provided by Jimi-Lab.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, and a public technical write-up detailing the attack vector is available, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for memory corruption via remote input.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the high severity of memory corruption vulnerabilities, immediate action is required. Organizations utilizing the Tenda F451 should restrict network access to the device and prioritize applying firmware updates as soon as they are made available by the vendor to prevent potential exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356543","name":"VDB-356543 | Tenda F451 RouteStatic fromRouteStatic stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356543/cti","name":"VDB-356543 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792858","name":"Submit #792858 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/5","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F451 router allows remote attackers to trigger memory corruption via the page argument in the /goform/RouteStatic endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F451 router allows remote code execution, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-5989

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) occurring in the fromRouteStatic function within the /goform/RouteStatic file. An authenticated attacker can trigger this memory corruption by manipulating the page argument, which can be executed remotely.

Business Impact

The exploitation of this vulnerability can lead to a full compromise of the affected routing device. Given the CVSS score of 8.8, this flaw represents a high risk as it allows for unauthorized code execution, potentially enabling lateral movement within the network, interception of traffic, or total loss of device availability, which could severely disrupt business operations.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should restrict administrative access to the device interface and disable remote management features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for unusual patterns directed at the /goform/RouteStatic endpoint and review device system logs for signs of repeated crashes or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall or network-level access control lists to filter traffic to the management interface, ensuring only trusted IP addresses can interact with the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at https://github.com/Jimi-Lab/cve/issues/5.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for memory corruption leading to arbitrary code execution.

Analyst Recommendation

The severity of this buffer overflow requires immediate attention from network administrators. Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations should prioritize isolating the affected Tenda F451 units from public-facing networks until the vendor releases a firmware patch that addresses the memory corruption issue in the fromRouteStatic function.

---METADATA---
VENDOR: Tenda
PRODUCT: F451
AFFECTED_VERSIONS: 1.0.0.7
CONFIDENCE: high
MISSING: patch
CREDITS: Jimi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356542","name":"VDB-356542 | Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356542/cti","name":"VDB-356542 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792857","name":"Submit #792857 | Tenda F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7 buffer overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Jimi-Lab/cve/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
Tenda F451 version 1.0.0.7 contains a stack-based buffer overflow in the formWrlsafeset function, allowing remote attackers to trigger memory corruption via the mit_ssid argument.

Executive Summary:
A remote stack-based buffer overflow vulnerability in Tenda F451 version 1.0.0.7 poses a severe risk of unauthorized code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5988

Affected Software: Tenda F451

Affected Versions: 1.0.0.7

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) triggered by manipulating the mit_ssid argument within the formWrlsafeset function located in /goform/AdvSetWrlsafeset. The CVSS vector indicates that while the attack is remote, it requires low privileges to initiate.

Business Impact

The vulnerability carries a CVSS score of 8.8, classifying it as a high-severity issue. Successful exploitation allows an attacker to corrupt memory, which typically leads to remote code execution or a denial of service condition. Such an event could result in a complete loss of device integrity, potentially allowing an adversary to pivot into the internal network and compromise sensitive business data.

Remediation Plan

Immediate Action: Since no official patch is currently identified, restrict access to the web management interface to trusted internal segments only and monitor vendor communications for firmware updates.

Proactive Monitoring: Review system logs for unusual traffic patterns targeting the /goform/AdvSetWrlsafeset endpoint or unexpected device reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing oversized or malicious payloads in the mit_ssid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/Jimi-Lab/cve/issues/4.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected argument.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-severity nature of memory corruption vulnerabilities, immediate mitigation is required. Administrators should isolate the affected Tenda F451 devices from public-facing networks and apply the vendor firmware update as soon as it becomes available to prevent potential remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: AC15
AFFECTED_VERSIONS: 15.03.05.18
CONFIDENCE: high
MISSING: none
CREDITS: meshaal (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356277","name":"VDB-356277 | Tenda AC15 SysToolChangePwd websGetVar stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356277/cti","name":"VDB-356277 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/789178","name":"Submit #789178 | Tenda AC15 15.03.05.18 Memory Corruption","tags":["third-party-advisory"]},{"url":"https://files.catbox.moe/xrk8jb.zip","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.939Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda AC15 version 15.03.05.18 allows remote attackers to trigger memory corruption via the websGetVar function in the SysToolChangePwd form.

Executive Summary:
A critical stack-based buffer overflow in the Tenda AC15 router allows remote attackers to achieve arbitrary code execution, posing a severe risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-5830

Affected Software: Tenda AC15

Affected Versions: 15.03.05.18

Vulnerability: This vulnerability involves a stack-based buffer overflow located in the websGetVar function within the /goform/SysToolChangePwd endpoint. While the CVSS vector indicates that low privileges are required, the flaw allows an attacker to corrupt memory remotely by manipulating the oldPwd, newPwd, or cfmPwd arguments.

Business Impact

The ability to trigger a buffer overflow in a network device often leads to remote code execution, granting an attacker full control over the router. This compromise can facilitate man-in-the-middle attacks, eavesdropping on internal traffic, and persistent unauthorized access to the local area network. Given the high CVSS score of 8.8, this flaw represents a significant threat to organizational data confidentiality and infrastructure integrity.

Remediation Plan

Immediate Action: Administrators must contact the vendor to obtain and install the latest firmware update that addresses this specific buffer overflow vulnerability.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP POST requests directed at the /goform/SysToolChangePwd endpoint, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or similar inspection tool to filter or block malformed input parameters sent to the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the form of a script provided via the vulnerability reference.

Analyst Notes: As of April 10, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a functional exploit script linked in the CVE record confirms that the technical barrier to entry for an attacker is low.

Analyst Recommendation

The critical nature of this buffer overflow, combined with the availability of a public proof-of-concept, necessitates immediate action. Organizations utilizing the Tenda AC15 router must verify their firmware version and prioritize the application of any available security patches to prevent potential remote compromise of their network perimeter.

---METADATA---
VENDOR: Tenda
PRODUCT: Router CX12L
AFFECTED_VERSIONS: 16.03.53.12
CONFIDENCE: high
MISSING: none
CREDITS: lv1020 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355514","name":"VDB-355514 | Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355514/cti","name":"VDB-355514 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792785","name":"Submit #792785 | Tenda CX12L V16.03.53.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/cve-a/lvdan/issues/5","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.243Z
---END_METADATA---

Description Summary:
Tenda CX12L firmware version 16.03.53.12 contains a stack-based buffer overflow in the /goform/NatStaticSetting endpoint, allowing remote code execution via a crafted page parameter.

Executive Summary:
A critical stack-based buffer overflow in Tenda CX12L routers allows unauthenticated remote attackers to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-5687

Affected Software: Tenda Router CX12L

Affected Versions: 16.03.53.12

Vulnerability: The vulnerability exists in the fromNatStaticSetting function within the /goform/NatStaticSetting endpoint, where the page parameter is processed using an unsafe sprintf call without length validation. This allows an unauthenticated attacker to supply an oversized input that overflows a 256-byte stack buffer, resulting in memory corruption or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. By gaining unauthorized access or control over the router, an attacker could intercept sensitive network traffic, modify configuration settings to facilitate man-in-the-middle attacks, or use the device as a pivot point to compromise internal network assets. Given the high CVSS score of 8.8, this flaw represents a significant threat to organizational data confidentiality and operational integrity.

Remediation Plan

Immediate Action: Update the Tenda CX12L firmware to the latest available version provided by the vendor, which includes the necessary bounds checking to prevent buffer overflow.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/NatStaticSetting endpoint, particularly those containing excessively large payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to block or sanitize incoming HTTP requests that contain oversized parameters directed at the vulnerable management URI.

Exploitation Status

Public Exploit Available: Yes — as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of April 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional proof-of-concept script significantly lowers the barrier to entry for attackers.

Analyst Recommendation

The vulnerability is severe and requires immediate attention due to the potential for unauthenticated remote code execution. Administrators should prioritize patching affected Tenda CX12L devices immediately. If an update cannot be applied instantly, isolate the management interface from the public internet to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: Router CX12L
AFFECTED_VERSIONS: 16.03.53.12
CONFIDENCE: high
MISSING: none
CREDITS: lv1020 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355513","name":"VDB-355513 | Tenda CX12L RouteStatic fromRouteStatic stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355513/cti","name":"VDB-355513 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792783","name":"Submit #792783 | Tenda CX12L V16.03.53.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/cve-a/lvdan/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.243Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the Tenda CX12L router via the fromRouteStatic function, allowing remote attackers to trigger memory corruption or arbitrary code execution.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda CX12L router allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5686

Affected Software: Tenda Router CX12L

Affected Versions: 16.03.53.12

Vulnerability: The vulnerability exists within the /goform/RouteStatic endpoint, where the fromRouteStatic function processes the page parameter using an unsafe sprintf call. This flaw allows an unauthenticated attacker to send an oversized input that exceeds the 256-byte buffer, leading to memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network security. An attacker gaining control over the router can monitor sensitive network traffic, intercept communications, or use the compromised device as a foothold to pivot into internal segments. Given the CVSS score of 8.8, this flaw represents a high risk to data confidentiality and system integrity.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor portal for firmware updates that address this buffer overflow, as no specific public patch version is currently listed.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/RouteStatic endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement firewall rules to restrict access to the device management interface to trusted internal IP addresses only, effectively mitigating remote attack vectors.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept Python script is available via the linked researcher write-up on GitHub.

Analyst Notes: As of April 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a functional proof-of-concept, necessitates immediate attention. Administrators must prioritize restricting access to the vulnerable endpoint and applying manufacturer firmware updates as soon as they are released to prevent potential device compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: Router CX12L
AFFECTED_VERSIONS: 16.03.53.12
CONFIDENCE: high
MISSING: patch
CREDITS: lv1020 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355512","name":"VDB-355512 | Tenda CX12L addressNat fromAddressNat stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355512/cti","name":"VDB-355512 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792782","name":"Submit #792782 | Tenda CX12L V16.03.53.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/cve-a/lvdan/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.247Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CX12L /goform/addressNat endpoint allows remote attackers to trigger memory corruption via the page parameter.

Executive Summary:
A critical stack-based buffer overflow in Tenda CX12L routers allows remote, unauthenticated attackers to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-5685

Affected Software: Tenda Router CX12L

Affected Versions: 16.03.53.12

Vulnerability: The vulnerability exists in the fromAddressNat function within the /goform/addressNat endpoint, where the application fails to perform bounds checking on the user-controlled page parameter before copying it into a fixed-size buffer using sprintf. This flaw is remotely exploitable without authentication.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for system compromise. Successful exploitation enables remote code execution, granting an attacker full control over the router, which can be leveraged to monitor network traffic, exfiltrate sensitive data, or pivot into internal network segments, leading to significant operational disruption and security breaches.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the device web management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /goform/addressNat endpoint, specifically looking for abnormally long string payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network filtering rule to inspect and block excessively long input parameters sent to the /goform/addressNat URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided technical write-up on GitHub.

Analyst Notes: As of April 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of input validation on a remote-facing administrative endpoint.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the critical nature of remote code execution, this vulnerability poses a severe risk to network integrity. Organizations utilizing the Tenda CX12L must isolate the device from external access immediately and monitor for vendor firmware updates, applying them as soon as they become available to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: CX12L
AFFECTED_VERSIONS: 16.03.53.12
CONFIDENCE: high
MISSING: patch
CREDITS: lv1020 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355511","name":"VDB-355511 | Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355511/cti","name":"VDB-355511 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/792781","name":"Submit #792781 | Tenda CX12L V16.03.53.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/cve-a/lvdan/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.247Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CX12L router allows attackers to crash the system or execute arbitrary code via a crafted page parameter in the webExcptypemanFilter function.

Executive Summary:
A critical stack-based buffer overflow in Tenda CX12L routers could allow an attacker on the local network to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5684

Affected Software: Tenda CX12L

Affected Versions: 16.03.53.12

Vulnerability: This is a stack-based buffer overflow vulnerability residing in the fromwebExcptypemanFilter function within the /goform/webExcptypemanFilter endpoint. The vulnerability is triggered when the application fails to perform bounds checking on the page parameter before copying it into a fixed-size buffer, allowing a local network attacker to manipulate memory and execution flow.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network security. An attacker capable of reaching the device via the local network could gain full control over the router, potentially leading to unauthorized monitoring of sensitive traffic, lateral movement into internal systems, or complete denial of service for network infrastructure. The CVSS score of 8.0 reflects the high potential for system compromise and the impact on availability and integrity.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict access to the web management interface to trusted administrative IP addresses only. If the device is not critical, consider isolating it from the main network until a firmware update is provided by Tenda.

Proactive Monitoring: Review device system logs for unexpected reboots or crashes, which may indicate attempted exploitation. Monitor network traffic for unusual POST requests directed at the /goform/webExcptypemanFilter endpoint.

Compensating Controls: Implement network segmentation to ensure the management interface of the router is not accessible from untrusted segments. Deploy a firewall or Intrusion Prevention System (IPS) rule to drop POST requests that contain abnormally large payloads in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub issue referenced by the CVE record.

Analyst Notes: As of April 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the binary lacks sufficient input validation on a network-facing endpoint.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the potential for arbitrary code execution, this vulnerability represents a significant threat to network integrity. Organizations utilizing the Tenda CX12L router should treat this as a high-priority issue. Apply the recommended compensating controls immediately and monitor vendor support channels for the release of a security-hardened firmware version.

---METADATA---
VENDOR: Tenda
PRODUCT: i12
AFFECTED_VERSIONS: 1.0.0.11(3862)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355400","name":"VDB-355400 | Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355400/cti","name":"VDB-355400 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/785337","name":"Submit #785337 | Tenda i12 V1.0.0.11(3862) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/i12/vul_107/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.263Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda i12 wifiSSIDset function allows remote attackers to trigger denial of service or remote code execution via a crafted index parameter.

Executive Summary:
A critical stack-based buffer overflow in Tenda i12 firmware allows remote attackers to achieve remote code execution, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-5609

Affected Software: Tenda i12

Affected Versions: 1.0.0.11(3862)

Vulnerability: This vulnerability resides in the formwrlSSIDset function within the /goform/wifiSSIDset endpoint. An attacker with low-level privileges can supply a crafted index or wl_radio parameter that lacks proper length validation, leading to a stack-based buffer overflow.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected device, potentially leading to a full system compromise. Given the CVSS score of 8.8, this represents a high-severity threat that could facilitate unauthorized network access, data exfiltration, or the permanent disruption of network services, resulting in significant operational downtime.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should restrict network access to the device management interface and disable the affected wireless configuration features if not required.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests directed at the /goform/wifiSSIDset endpoint, particularly those containing unusually long string payloads in the index parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to inspect and block requests to the vulnerable endpoint that exceed expected parameter lengths.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of April 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-supplied input during the processing of wireless settings.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating affected Tenda i12 devices from external networks and monitor vendor channels for the release of a security update. Applying the update as soon as it becomes available is the only definitive method to eliminate this risk.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355397","name":"VDB-355397 | Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355397/cti","name":"VDB-355397 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/785052","name":"Submit #785052 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_54/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.263Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda CH22 version 1.0.0.1 allows remote attackers to execute code via the GO parameter in the /goform/WrlExtraSet endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda CH22 routers may allow remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5605

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the formWrlExtraSet function of the /goform/WrlExtraSet endpoint, where the GO argument is processed without adequate length validation. This memory corruption flaw requires the attacker to have low-level privileges to interact with the vulnerable function, potentially leading to stack-based buffer overflow.

Business Impact

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and availability of the affected network device. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized remote code execution, leading to complete device takeover or systemic service disruption for connected users.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should restrict network access to the management interface and the /goform/WrlExtraSet endpoint to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /goform/WrlExtraSet, specifically monitoring for unusually large input values in the GO parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing excessive data within the GO parameter field.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of April 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks when processing user-supplied input.

Analyst Recommendation

Due to the high CVSS score and the public availability of exploit code, this vulnerability poses a significant risk to network infrastructure. Organizations using the Tenda CH22 device should prioritize isolating the management interface from the public internet and continue to monitor vendor channels for the release of an official firmware update.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355396","name":"VDB-355396 | Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355396/cti","name":"VDB-355396 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/785032","name":"Submit #785032 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_52/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.263Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 router allows remote attackers to trigger denial of service or remote code execution via a crafted parameter in the CertLocalPrecreate function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda CH22 devices poses a significant risk of remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5604

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: This vulnerability is a stack-based buffer overflow located in the formCertLocalPrecreate function within the /goform/CertLocalPrecreate endpoint. An attacker with low privileges can trigger this memory corruption by sending a specially crafted standard argument to the affected parameter, potentially leading to remote code execution.

Business Impact

The ability for an unauthenticated or low-privileged attacker to achieve remote code execution on a network device represents a severe threat to internal infrastructure. With a CVSS score of 8.8, this flaw could allow attackers to bypass perimeter security, intercept network traffic, or pivot further into the local network. Successful exploitation would likely result in complete loss of device control and potential compromise of connected systems.

Remediation Plan

Immediate Action: Contact Tenda support or monitor the official Tenda website for firmware updates addressing this vulnerability, as no official patch is currently listed. If an update is unavailable, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web access logs for unusual POST requests directed at the /goform/CertLocalPrecreate endpoint, specifically looking for abnormally long string patterns in the standard parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long inputs sent to the /goform/CertLocalPrecreate path.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published technical write-up on GitHub.

Analyst Notes: As of April 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's reliance on a lack of length checking in a standard C function makes it highly susceptible to exploitation by unsophisticated actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of remote code execution, security teams must treat this as a priority. Immediately isolate affected devices from external network exposure and monitor for any signs of anomalous traffic targeting the identified management function until a vendor-supplied firmware fix is applied.

---METADATA---
VENDOR: Tenda
PRODUCT: M3 Access Controller
AFFECTED_VERSIONS: 1.0.0.10
CONFIDENCE: high
MISSING: none
CREDITS: Doma (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355337","name":"VDB-355337 | Tenda M3 Destination setAdvPolicyData buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355337/cti","name":"VDB-355337 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/782999","name":"Submit #782999 | Tenda Tenda M3 Access Controller(M3) V1.0.0.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Moxxkidd/CVE/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.263Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the Tenda M3 Access Controller firmware version 1.0.0.10 within the setAdvPolicyData function, allowing remote attackers to trigger a denial of service.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda M3 Access Controller allows a remote, authenticated attacker to trigger a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2026-5567

Affected Software: Tenda M3 Access Controller

Affected Versions: 1.0.0.10

Vulnerability: The vulnerability is a buffer overflow occurring in the setAdvPolicyData function when handling the rebootTime parameter. An authenticated attacker can supply a specially crafted string to the web interface to overwrite memory and crash the device service.

Business Impact

The exploitation of this vulnerability results in a denial of service, rendering the Tenda M3 Access Controller management interface unresponsive. Given the CVSS score of 8.8, this poses a high risk to operational continuity, as administrators may lose the ability to manage network policies or perform critical configuration tasks until the device is manually recovered.

Remediation Plan

Immediate Action: Users should contact Tenda support or monitor the official Tenda website for a firmware update that addresses the unsafe use of the strncpy function.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests directed at the /goform/setAdvPolicyData endpoint that contain unusually long strings in the rebootTime parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and restrict the length of input parameters submitted to the /goform/setAdvPolicyData interface to prevent malformed data from reaching the vulnerable function.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the referenced GitHub security issue.

Analyst Notes: As of April 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the rebootTime parameter.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent potential service disruptions. Administrators are urged to restrict access to the management interface of affected Tenda M3 devices to trusted internal networks only and to apply the necessary firmware patches as soon as they are made available by the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: AC10
AFFECTED_VERSIONS: Tenda AC10: 16.03.10.10_multi_TDE01
CONFIDENCE: high
MISSING: patch
CREDITS: CoreNode (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355314","name":"VDB-355314 | Tenda AC10 httpd fromSysToolChangePwd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355314/cti","name":"VDB-355314 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/782299","name":"Submit #782299 | Tenda AC10 V4 US_AC10V4.0si_V16.03.10.10_multi_TDE01 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/HIGH-01-getvalue-229-callers.md","name":null,"tags":["related"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.283Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC10 /bin/httpd service allows remote attackers to trigger memory corruption via the fromSysToolChangePwd function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC10 firmware version 16.03.10.10_multi_TDE01 presents a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5550

Affected Software: Tenda AC10

Affected Versions: Tenda AC10: 16.03.10.10_multi_TDE01

Vulnerability: The vulnerability exists in the fromSysToolChangePwd function within the /bin/httpd binary. An authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or service disruption.

Business Impact

The CVSS score of 8.8 indicates a high severity rating, reflecting the potential for total loss of confidentiality, integrity, and availability of the affected router. Exploitation of this flaw could allow an attacker to gain unauthorized control over network infrastructure, facilitating further lateral movement within the corporate environment or interception of sensitive traffic.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the web management interface to trusted internal networks only. If possible, disable remote management features until the vendor provides a firmware update.

Proactive Monitoring: Monitor device logs for unusual crashes of the /bin/httpd process or repeated failed login attempts that might indicate exploitation reconnaissance.

Compensating Controls: Deploy network segmentation to isolate the affected Tenda devices from critical internal assets and utilize a firewall to block unauthorized access to the router management port.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its location in the core HTTP daemon, which is exposed to network input.

Analyst Recommendation

Given the high CVSS score and the nature of the buffer overflow, this vulnerability poses a significant risk to network security. Administrators must prioritize the isolation of the Tenda AC10 management interface immediately and monitor official Tenda support channels for the release of a patched firmware version.

---METADATA---
VENDOR: Tenda
PRODUCT: AC10
AFFECTED_VERSIONS: Tenda AC10: 16.03.10.10_multi_TDE01
CONFIDENCE: high
MISSING: patch
CREDITS: CoreNode (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355312","name":"VDB-355312 | Tenda AC10 httpd fromSysToolChangePwd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355312/cti","name":"VDB-355312 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/782297","name":"Submit #782297 | Tenda AC10 V4 US_AC10V4.0si_V16.03.10.10_multi_TDE01 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-04-stackoverflow-fromsystoolchangepwd.md","name":null,"tags":["related"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.283Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC10 /bin/httpd binary allows remote attackers to trigger memory corruption via the sys.userpass argument in the fromSysToolChangePwd function.

Executive Summary:
A critical stack-based buffer overflow in the Tenda AC10 router allows remote attackers to achieve unauthorized code execution, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-5548

Affected Software: Tenda AC10

Affected Versions: Tenda AC10: 16.03.10.10_multi_TDE01

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the fromSysToolChangePwd function of the /bin/httpd service. An attacker with low-level privileges can trigger this memory corruption by manipulating the sys.userpass argument, potentially leading to system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity. Successful exploitation allows for remote memory corruption, which can lead to complete device takeover, unauthorized access to network traffic, or the redirection of internal traffic to malicious endpoints. Such an event would result in significant operational disruption and the potential compromise of sensitive data traversing the local network.

Remediation Plan

Immediate Action: Since a vendor patch is currently unknown, administrators should isolate the management interface of the Tenda AC10 from the internet and restrict access to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for unusual crashes of the /bin/httpd service or repeated failed authentication attempts that may indicate exploitation probes.

Compensating Controls: If the device supports it, configure a robust firewall rule to block all inbound traffic to the administrative interface from untrusted sources, effectively mitigating the remote attack vector.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing attack details exists via the vulnerability research repository listed in the references.

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation in the wild. The vulnerability is inherently exploitable due to the lack of bounds checking on the sys.userpass argument within the administrative function.

Analyst Recommendation

Given the high CVSS severity and the nature of the buffer overflow, immediate steps must be taken to limit the attack surface. Administrators should prioritize restricting network access to the device management interface and check the vendor support portal frequently for firmware updates that address this memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: 4G03 Pro
AFFECTED_VERSIONS: 1.0, 1.1, 04.03.01.0, 04.03.01.1, 04.03.01.2, 04.03.01.3, 04.03.01.4, 04.03.01.5
CONFIDENCE: high
MISSING: patch, technical_details
CREDITS: CoreNode (VulDB User) (reporter); VulDB Vulnerability Moderation Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/355279","name":"VDB-355279 | Tenda 4G03 Pro httpd access control","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/355279/cti","name":"VDB-355279 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/782052","name":"Submit #782052 | Tenda Tenda 4G03 Pro V1.0 V04.03.01.53 Authentication Bypass Issues","tags":["third-party-advisory"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.283Z
---END_METADATA---

Description Summary:
A remote improper access control vulnerability exists in the Tenda 4G03 Pro router within the /bin/httpd component, potentially allowing unauthorized access.

Executive Summary:
The Tenda 4G03 Pro router is susceptible to a remote improper access control vulnerability that could allow unauthorized actors to manipulate system functionality.

Vulnerability Details

CVE-ID: CVE-2026-5526

Affected Software: Tenda 4G03 Pro

Affected Versions: 1.0, 1.1, 04.03.01.0, 04.03.01.1, 04.03.01.2, 04.03.01.3, 04.03.01.4, 04.03.01.5

Vulnerability: This vulnerability involves improper access controls and incorrect privilege assignment within the /bin/httpd binary, which can be triggered remotely by an unauthenticated attacker.

Business Impact

The exploitation of this vulnerability poses a significant risk to network integrity and confidentiality, as it enables remote attackers to bypass access restrictions on the device. With a CVSS score of 7.3, this flaw is categorized as High severity, indicating that unauthorized parties could potentially gain control over router settings or expose sensitive internal network traffic. Failure to address this could lead to full compromise of the edge device and unauthorized access to the local area network.

Remediation Plan

Immediate Action: Check the official Tenda support website for firmware updates addressing this flaw and apply them to all affected units immediately.

Proactive Monitoring: Monitor firewall logs and router management access attempts for suspicious traffic patterns originating from unauthorized external IP addresses.

Compensating Controls: Restrict management interface access to trusted administrative IP addresses only, and disable remote web-based management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes — per the CVE record, the exploit has been released to the public.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild, but the existence of a public exploit significantly increases the risk of opportunistic attacks. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the remote exploitability and the confirmed availability of public exploit code, this vulnerability represents a high risk to the security of the internal network. Administrators should prioritize identifying all affected Tenda 4G03 Pro devices and applying the latest available security patches as soon as they are provided by the vendor. In environments where patching is delayed, isolating the management interface from the public internet is essential to prevent unauthorized access.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354332","name":"VDB-354332 | Tenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354332/cti","name":"VDB-354332 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780209","name":"Submit #780209 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_49/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 web interface allows remote attackers to trigger memory corruption and potentially achieve remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda CH22 router, discovered in version 1.0.0.1, poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5204

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the formWebTypeLibrary function of the /goform/webtypelibrary endpoint, where the webSiteId parameter is processed by an unsafe strcat call without length verification. This flaw allows a remote, authenticated attacker to trigger a stack-based buffer overflow, leading to potential denial of service or remote code execution.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to unauthorized network access, interception of sensitive traffic, and total compromise of the internal gateway.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict access to the device management interface to trusted internal segments only. Contact Tenda support or monitor the official vendor portal for firmware updates addressing this memory corruption flaw.

Proactive Monitoring: Review system logs for unusual HTTP POST requests directed at /goform/webtypelibrary and monitor for unexpected device reboots or service crashes.

Compensating Controls: Implement an access control list (ACL) on the router to block external access to the web-based management interface, ensuring only authorized administrative workstations can reach the management service.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional exploit script makes this a high-priority item for network hardening.

Analyst Recommendation

Given the exposure of the administrative interface and the presence of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently using Tenda CH22 devices in version 1.0.0.1 must prioritize isolating these devices from the public internet and applying forthcoming firmware updates as soon as they are made available by the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: CP3 V3.0
AFFECTED_VERSIONS: Tenda CP3 V3.0 firmware V31.1.9.91
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CP3 V3.0 RTSP service allows unauthenticated remote attackers to cause a denial-of-service condition.

Executive Summary:
A critical stack-based buffer overflow in Tenda CP3 V3.0 firmware enables remote, unauthenticated attackers to crash the device's RTSP service.

Vulnerability Details

CVE-ID: CVE-2026-51601

Affected Software: Tenda CP3 V3.0

Affected Versions: Tenda CP3 V3.0 firmware V31.1.9.91

Vulnerability: The vulnerability exists in the RTSP service, where the device fails to properly validate the length of the 'clock=' parameter within the Range header of a PLAY request. An unauthenticated remote attacker can trigger a stack-based buffer overflow after completing a standard RTSP handshake, leading to a service crash.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a High severity risk. Successful exploitation results in a Denial of Service (DoS), effectively rendering the security camera or device unresponsive. In a business context, this leads to loss of operational visibility, potential security gaps in monitoring, and the requirement for manual device reboots to restore functionality.

Remediation Plan

Immediate Action: Since no specific patch version is currently available, restrict network access to the RTSP service (typically port 554) to trusted management subnets only.

Proactive Monitoring: Monitor device logs and RTSP traffic for anomalous 'PLAY' requests or unexpected service restarts that may indicate attempted exploitation.

Compensating Controls: Deploy a Network Intrusion Prevention System (NIPS) or firewall rules to drop RTSP packets containing malformed or excessively long header values.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements, allowing any network-adjacent attacker to interrupt services.

Analyst Recommendation

Given the lack of a verified vendor patch, organizations should prioritize network-level segmentation to shield the affected devices from external exposure. Administrators must monitor for vendor updates regarding firmware V31.1.9.91 and apply them immediately upon release to remediate the underlying buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354188","name":"VDB-354188 | Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354188/cti","name":"VDB-354188 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780208","name":"Submit #780208 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_46/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 formQuickIndex function allows remote attackers to trigger memory corruption and potential code execution via the mit_linktype parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda CH22 routers poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-5156

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the formQuickIndex function of the /goform/QuickIndex endpoint. By sending a crafted POST request with an oversized mit_linktype argument, an authenticated attacker can trigger a stack-based buffer overflow, leading to memory corruption or arbitrary code execution.

Business Impact

The CVSS score of 8.8 reflects the high potential for system compromise. Successful exploitation could allow an attacker to gain full control over the networking device, facilitating unauthorized access to the internal network, traffic interception, or complete denial of service. Such a compromise poses a significant risk to the confidentiality, integrity, and availability of business operations.

Remediation Plan

Immediate Action: Contact Tenda support or check the official Tenda website for firmware updates addressing this buffer overflow. If no patch is currently available, restrict access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/QuickIndex endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Deploy a Web Application Firewall or an intrusion prevention system to filter and block malformed HTTP requests that exceed expected length constraints for the mit_linktype parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up linked in the vulnerability references.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform boundary checks on user-provided input before processing it in memory.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of potential remote code execution, this vulnerability represents a significant threat. Administrators must prioritize restricting management access to the affected Tenda CH22 devices immediately and apply vendor-supplied firmware updates as soon as they become available to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354187","name":"VDB-354187 | Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354187/cti","name":"VDB-354187 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780207","name":"Submit #780207 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_47/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 router allows remote attackers to trigger denial of service or remote code execution via the wanmode parameter in the /goform/AdvSetWan endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda CH22 firmware allows remote attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-5155

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the fromAdvSetWan function, which fails to perform adequate length validation on the wanmode and PPPOEPassword parameters. This memory corruption flaw allows a remote attacker with low-level privileges to overflow the stack buffer during parameter handling.

Business Impact

Successful exploitation of this vulnerability can result in full system compromise, including the ability for an attacker to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this poses a high risk to business operations, as it could lead to unauthorized network access, data exfiltration, or complete service disruption of the affected networking hardware.

Remediation Plan

Immediate Action: Contact the vendor or check the official Tenda support portal for firmware updates addressing this buffer overflow. If no patch is currently available, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/AdvSetWan endpoint, specifically looking for abnormally long parameter strings. Review system logs for unexpected reboots or service crashes that may indicate an exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing oversized payloads in the wanmode field.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software lacks essential bounds checking on user-supplied input.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate attention. Security teams should prioritize restricting access to the device management interface while awaiting an official firmware patch from Tenda. Failure to mitigate this risk leaves the infrastructure vulnerable to remote execution and denial of service attacks.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1, 1.If
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354186","name":"VDB-354186 | Tenda CH22 Parameter setcfm fromSetCfm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354186/cti","name":"VDB-354186 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780206","name":"Submit #780206 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_48/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 parameter handler allows remote attackers to trigger a denial of service or execute arbitrary code via the funcname argument in /goform/setcfm.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda CH22 router allows authenticated attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-5154

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1, 1.If

Vulnerability: The vulnerability exists within the fromSetCfm function in the /goform/setcfm endpoint, where the funcpara1 parameter is processed without adequate length validation. This memory corruption flaw, classified as a stack-based buffer overflow, requires the attacker to have low-level access to the device to trigger the malicious payload.

Business Impact

Successful exploitation of this vulnerability can result in full system compromise, including remote code execution (RCE) or persistent denial of service (DoS). Given the CVSS score of 8.8, this represents a high-severity threat that could lead to unauthorized network control or data interception. Organizations relying on these devices should treat this as a significant risk to internal network integrity.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor portal for firmware updates addressing this buffer overflow, as no public patch is currently confirmed. Until a patch is applied, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /goform/setcfm endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Implement network-level access control lists (ACLs) to prevent unauthorized devices from reaching the administrative interface of the router.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-provided input, which allows for reliable memory corruption.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to affected Tenda CH22 devices. Administrators must prioritize isolating these devices from external networks and remain vigilant for vendor-issued firmware updates to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354184","name":"VDB-354184 | Tenda CH22 createFileName formCreateFileName stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354184/cti","name":"VDB-354184 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780203","name":"Submit #780203 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_50/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
Tenda CH22 version 1.0.0.1 contains a stack-based buffer overflow in the formCreateFileName function, which may allow remote attackers to execute arbitrary code or cause a denial of service.

Executive Summary:
A critical stack-based buffer overflow in the Tenda CH22 router firmware allows remote attackers to achieve remote code execution or system disruption.

Vulnerability Details

CVE-ID: CVE-2026-5152

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the formCreateFileName function of the /goform/createFileName endpoint. By supplying a specially crafted fileNameMit parameter, an authenticated attacker can trigger a memory corruption event, leading to a stack-based buffer overflow.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network security. As the flaw allows for remote code execution, an attacker could gain full control over the router, facilitating lateral movement within the internal network, traffic interception, or permanent denial of service. Given the CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate prioritization in security patching cycles.

Remediation Plan

Immediate Action: Check the official Tenda support portal for firmware updates addressing this vulnerability. If no patch is currently available for version 1.0.0.1, restrict administrative access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/createFileName endpoint. Review system logs for unexpected crashes or service restarts that may indicate attempted exploitation.

Compensating Controls: If the device is exposed to the internet, immediately place the management interface behind a firewall or VPN to prevent remote access by unauthorized actors.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a functional proof-of-concept demonstrates that the vulnerability is easily reproducible by malicious actors.

Analyst Recommendation

The severity of this remote code execution vulnerability necessitates urgent action. Administrators should verify the current firmware version of all Tenda CH22 devices and apply vendor-supplied security patches as soon as they are released. Until a patch is verified and deployed, limiting access to the management interface is the most effective method to reduce the attack surface and prevent unauthorized exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: AC10 v3
AFFECTED_VERSIONS: firmware V03.03.16.09
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.tendacn.com/material/show/104968","name":null,"tags":[]},{"url":"https://github.com/snyi001/CV/blob/main/11.zip","name":null,"tags":[]},{"url":"https://github.com/snyi001/Tenda-AC10-v3","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda AC10 v3 firmware allows unauthenticated remote attackers to trigger a permanent denial of service or execute arbitrary code via the /cgi-bin/UploadCfg endpoint.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC10 v3 routers allows unauthenticated remote attackers to achieve full system compromise or permanent denial of service.

Vulnerability Details

CVE-ID: CVE-2026-51380

Affected Software: Tenda AC10 v3

Affected Versions: firmware V03.03.16.09

Vulnerability: The flaw is a buffer overflow occurring within the /cgi-bin/UploadCfg endpoint, which fails to properly validate input data. This allows an unauthenticated, network-adjacent or remote attacker to bypass security controls and execute arbitrary code or render the device permanently unusable.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Given the CVSS score of 9.8, the potential for unauthorized remote code execution means an attacker could gain full control over the router, facilitating lateral movement into internal segments or intercepting sensitive traffic. This could lead to significant data breaches, sustained service outages, and compromised operational integrity.

Remediation Plan

Immediate Action: Restrict access to the router management interface from untrusted networks and check the official Tenda support portal for firmware updates that address this vulnerability.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /cgi-bin/UploadCfg URI, which may indicate attempted exploitation.

Compensating Controls: Implement access control lists (ACLs) on the WAN interface to block external access to administrative endpoints and utilize a firewall to drop suspicious traffic patterns targeting the router management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted at github.com/snyi001/Tenda-AC10-v3.

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the nature of the buffer overflow flaw.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate action is required to secure affected Tenda AC10 v3 devices. Administrators should ensure that management interfaces are not exposed to the public internet and prioritize applying vendor-supplied firmware patches as soon as they become available to prevent potential system compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1201
AFFECTED_VERSIONS: 1.2.0.14(408)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/353969","name":"VDB-353969 | Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/353969/cti","name":"VDB-353969 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/779127","name":"Submit #779127 | Tenda FH1201 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/FH1201/vul_44/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.187Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda FH1201 router, allowing remote attackers to trigger memory corruption and potential code execution via the GO parameter in the WrlExtraSet function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda FH1201 routers enables remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5046

Affected Software: Tenda FH1201

Affected Versions: 1.2.0.14(408)

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) located in the formWrlExtraSet function within the /goform/WrlExtraSet endpoint. An attacker with low privileges can supply a maliciously crafted GO argument to trigger memory corruption, potentially leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and security. An attacker can gain control over the affected router, facilitating unauthorized access to internal network traffic, data interception, or the deployment of persistent threats within the environment. Given the CVSS score of 8.8, this flaw is categorized as High severity, necessitating immediate attention to prevent potential system compromise and unauthorized lateral movement.

Remediation Plan

Immediate Action: Contact the vendor for firmware updates addressing this buffer overflow. If no patch is currently available, restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlExtraSet endpoint and inspect system logs for device crashes or unexpected reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to filter or drop requests containing excessively long strings within the GO parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is publicly available via a researcher write-up hosted on GitHub.

Analyst Notes: As of March 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the availability of a published proof-of-concept, the exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of boundary checks on the user-provided input.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the risk of exploitation by opportunistic actors. Organizations currently using the Tenda FH1201 device should prioritize isolating the hardware from public-facing interfaces and verify vendor support channels for a firmware update. Failure to address this vulnerability may lead to complete compromise of the network gateway.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1201
AFFECTED_VERSIONS: 1.2.0.14(408)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/353968","name":"VDB-353968 | Tenda FH1201 Parameter WrlclientSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/353968/cti","name":"VDB-353968 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/779126","name":"Submit #779126 | Tenda FH1201 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/FH1201/vul_43/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.187Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda FH1201 router due to improper length validation of the GO argument in the WrlclientSet function, potentially allowing remote code execution.

Executive Summary:
A critical stack-based buffer overflow in Tenda FH1201 firmware allows remote attackers to compromise device integrity and trigger code execution.

Vulnerability Details

CVE-ID: CVE-2026-5045

Affected Software: Tenda FH1201

Affected Versions: 1.2.0.14(408)

Vulnerability: This vulnerability is a stack-based buffer overflow located in the WrlclientSet function of the /goform/WrlclientSet endpoint. An authenticated attacker can trigger the flaw by sending a specially crafted GO parameter, which lacks necessary length verification before being passed to internal memory-handling functions.

Business Impact

The exploitation of this vulnerability can result in full system compromise, including remote code execution or a persistent denial of service condition. Given the CVSS score of 8.8, this flaw represents a significant risk to network availability and security, as the device acts as a critical gateway for traffic. Unauthorized control over the router could lead to traffic interception, credential theft, or the use of the device as a pivot point for lateral movement within the local network.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the web management interface to trusted internal IP addresses only. If the device is exposed to the internet, disable remote management features immediately.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /goform/WrlclientSet, particularly those containing abnormally long strings in the GO parameter field.

Compensating Controls: Deploy a network-level Web Application Firewall or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing oversized GO parameters destined for the WrlclientSet endpoint.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of March 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input during the processing of form data.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS severity, this vulnerability poses a credible threat to the security of the affected Tenda FH1201 devices. Organizations should prioritize isolating these devices from external access and monitor for any signs of anomalous traffic or service instability. Until a firmware update is provided by Tenda, strict network segmentation and limiting administrative access are the most effective measures to mitigate the risk of remote compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: 4G06
AFFECTED_VERSIONS: 04.06.01.29
CONFIDENCE: high
MISSING: none
CREDITS: kiciot (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/353962","name":"VDB-353962 | Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/353962/cti","name":"VDB-353962 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/778625","name":"Submit #778625 | Tenda 4G06 V04.06.01.29 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Kiciot/cve/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.195Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda 4G06 router allows remote attackers to cause a denial of service or execute arbitrary code by sending a crafted request to the /goform/DhcpListClient endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda 4G06 routers allows unauthenticated remote attackers to compromise device integrity or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5036

Affected Software: Tenda 4G06

Affected Versions: 04.06.01.29

Vulnerability: The vulnerability exists within the fromDhcpListClient function, which fails to perform adequate bounds checking on the page parameter, allowing an unauthenticated remote attacker to overflow a fixed-size buffer.

Business Impact

Successful exploitation of this flaw can result in a total loss of confidentiality, integrity, and availability for the affected network device. Given the CVSS score of 8.8, this represents a high-severity risk, as an attacker gaining control of a router can intercept network traffic, modify configurations, or use the device as a persistent pivot point to attack internal network resources.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor website for firmware updates addressing this buffer overflow and apply the patch as soon as it becomes available.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/DhcpListClient endpoint and review device logs for signs of unexpected process crashes or reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to block malicious, oversized payloads targeting the management interface until a permanent firmware update is applied.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher write-up referenced in the CVE record.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication to reach the vulnerable function.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate attention. Administrators must prioritize updating the firmware of all affected Tenda 4G06 units to a patched version to prevent potential remote code execution and unauthorized access to network infrastructure.