Which versions of F451 are affected by CVE-2026-11556?

Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) contain a remote command injection vulnerability exploitable with low-privilege web management credentials, enabling complete compromise of network…

Is there a public PoC exploit available for CVE-2026-11556?

Yes, a public proof-of-concept exploit is available for CVE-2026-11556. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-11556?

Within 24 hours: Audit all Tenda F451 devices in production; immediately restrict web management interface access to trusted administrative networks only and disable remote access if possible. Within 7 days: Contact Tenda support to confirm patch availability and end-of-life status; initiate procurement of replacement equipment from vendors with demonstrated active security support. Within 30 days: Complete hardware replacement; decommission all affected F451 devices from production.

F451 CVE-2026-11556

Q: What is the CVSS score of CVE-2026-11556?

CVE-2026-11556 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-35179 HIGH

OS Command Injection (CWE-78)

2026-06-08 VulDB

GHSA-47fv-fgr6-m346

Tenda Command Injection F451

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:32 vuln.today

CVSS changed

Jun 08, 2026 - 18:22 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) allows remote attackers with low-privileged web management access to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the /goform/WriteFacMac endpoint handled by the formWriteFacMac function. Publicly available exploit code exists, raising the practical risk for any device exposing the web management interface to untrusted networks. The flaw is rated CVSS 4.0 base 7.4 with high confidentiality, integrity, and availability impact on the device itself.