EUVD-2026-35180Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach Web Management Interface
-
DeliveryAuthenticate with low-privileged credentials
-
ExploitSend crafted POST to /goform/Natlimit
-
InstallOverflow stack buffer via 'page' argument
-
C2Overwrite saved return address
-
ExecuteHijack control flow on router
-
ImpactCompromise device and pivot into LAN
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the device's Web Management Interface (HTTP admin daemon) and valid low-privileged credentials to authenticate before invoking /goform/Natlimit (CVSS PR:L). Exploitation is constrained to Tenda F451 firmware 1.0.0.7 and 1.0.0.9, requires sending an oversized 'page' argument to the fromNatlimit handler, and no user interaction is needed (UI:N). Devices with the management interface restricted to LAN/management VLAN and using strong unique admin passwords substantially limit reachable attack surface; WAN-exposed admin panels or default credentials remove that limitation. |
| Impact | The CVSS 4.0 score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network reachability, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability, but requires low privileges (PR:L) - meaning a valid admin/management credential is needed, which sharply limits internet-scale exploitation against properly configured devices. Publicly available exploit code exists (per VulDB and the linked GitHub PoC), but there is no CISA KEV listing and no EPSS score supplied, so this should be treated as a credible but not confirmed-in-the-wild threat. The realistic risk is highest where the web management interface is exposed to the WAN or where default/weak credentials are in use; in well-segmented deployments behind authentication the practical risk drops considerably. No EPSS value is provided in the input - quantitative likelihood cannot be cross-referenced. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed a low-privileged administrator credential (or reached an exposed management interface with default credentials) sends a crafted HTTP request to /goform/Natlimit with an oversized 'page' parameter. The fromNatlimit function copies the value onto the stack without bounds checking, overwriting the saved return address; the publicly posted PoC at the Robots10/IoT_vlu repository demonstrates the crash and parameter shape, providing a direct foothold for further weaponization on these embedded targets. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Stack-based buffer overflow in the Tenda F451 router (firmware 1.0.0.7 and 1.0.0.9) Web Management Interface allows remote authenticated attackers to corrupt memory by sending a crafted 'page' argument to the fromNatlimit handler at /goform/Natlimit. Publicly available exploit code exists, raising practical risk for exposed or LAN-reachable devices, though no public exploit identified as actively used in CISA KEV at time of analysis.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda F451 router (firmware 1.0.0.7 and 1.0.0.9) Web Management Interface allows remote authenticated attackers to corrupt memory by submitting a crafted 'page' argument to the fromNatlimit handler at /goform/Natlimit. Publicly available exploit code exists, raising the likelihood of opportunistic attacks against exposed management interfaces, though the issue is not currently listed in CISA KEV. The flaw enables high impact to confidentiality, integrity, and availability of the device per the CVSS 4.0 vector.
Stack-based buffer overflow in the Tenda F451 router (firmware 1.0.0.7 and 1.0.0.9) allows authenticated remote attackers to corrupt memory via the page parameter of the fromNatlimit handler at /goform/Natlimit. Publicly available exploit code exists, raising the likelihood of opportunistic exploitation against exposed management interfaces, though no confirmed in-the-wild activity has been reported. CVSS 8.8 reflects high confidentiality, integrity, and availability impact with low attacker complexity.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://www.tenda.com.cn/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-11557 for a firmware update covering versions beyond 1.0.0.9. In the interim, restrict access to the Web Management Interface to trusted management VLANs only and disable any WAN-side remote administration so /goform/Natlimit is not reachable from the internet (trade-off: loss of remote admin convenience). Enforce strong, unique administrator passwords and rotate credentials, since exploitation requires PR:L - credential hygiene materially reduces exposure. Where feasible on aging SOHO hardware without a forthcoming fix, plan device replacement, as embedded routers without active firmware support frequently accumulate similar stack overflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda F451 is a SOHO/SMB router whose embedded HTTP administration daemon exposes /goform/* endpoints implemented in native C handlers. The vulnerable fromNatlimit function processes the 'page' query parameter without adequate bounds checking before copying it onto a fixed-size stack buffer, matching CWE-121 (Stack-based Buffer Overflow). On MIPS/ARM embedded Linux targets typical of Tenda devices, such overflows commonly overwrite the saved return address or function pointers, and the lack of modern mitigations (ASLR, stack canaries, NX) on this class of firmware historically makes them straightforward to weaponize into command execution. The single affected CPE is cpe:2.3:a:tenda:f451 covering the listed firmware revisions.
Know when F451 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A stack-based buffer overflow in Tenda F451 router firmware versions 1.0.0.7 and 1.0.0.9 allows authenticated attackers to corrupt memory and compromise router operations. Publicly available exploit code exists, creating immediate exploitation risk for any organization with these devices exposed on accessible networks, with no vendor patch available for remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network-level access to router management interfaces via firewall rules and IP whitelisting to authorized subnets only; (2) Disable unnecessary services including remote management and UPnP; (3) Implement VLAN segmentation isolating routers from critical business systems; (4) Monitor device logs and firewall records for exploitation attempts targeting /goform/Natlimit endpoint; (5) Develop hardware replacement plan with vendor equipment offering patch support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
OS command injection in Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) allows remote attackers with low-privileged we
Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7 enables authenticated remote attackers to execute arbi
Buffer overflow in Tenda F451 router firmware 1.0.0.7_cn_svn7958 allows authenticated remote attackers to achieve comple
Buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to achieve arbit
Remote buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated attackers to achieve arbit
Stack-based buffer overflow in Tenda F451 wireless router (firmware 1.0.0.7_cn_svn7958) allows authenticated remote atta
Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7_cn_svn7958 allows authenticated remote attacke
Stack-based buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to a
Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7 allows authenticated remote attackers to achieve compl
Stack-based buffer overflow in Tenda F451 router version 1.0.0.7 allows authenticated remote attackers to execute arbitr
Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7 allows authenticated remote attackers to achie
Stack-based buffer overflow in Tenda F451 router version 1.0.0.7 allows authenticated remote attackers to achieve comple
Exploit-DB