EUVD-2026-35180Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Stack-based buffer overflow in the Tenda F451 router (firmware 1.0.0.7 and 1.0.0.9) Web Management Interface allows remote authenticated attackers to corrupt memory by sending a crafted 'page' argument to the fromNatlimit handler at /goform/Natlimit. Publicly available exploit code exists, raising practical risk for exposed or LAN-reachable devices, though no public exploit identified as actively used in CISA KEV at time of analysis.
Technical ContextAI
The Tenda F451 is a SOHO/SMB router whose embedded HTTP administration daemon exposes /goform/* endpoints implemented in native C handlers. The vulnerable fromNatlimit function processes the 'page' query parameter without adequate bounds checking before copying it onto a fixed-size stack buffer, matching CWE-121 (Stack-based Buffer Overflow). On MIPS/ARM embedded Linux targets typical of Tenda devices, such overflows commonly overwrite the saved return address or function pointers, and the lack of modern mitigations (ASLR, stack canaries, NX) on this class of firmware historically makes them straightforward to weaponize into command execution. The single affected CPE is cpe:2.3:a:tenda:f451 covering the listed firmware revisions.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://www.tenda.com.cn/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-11557 for a firmware update covering versions beyond 1.0.0.9. In the interim, restrict access to the Web Management Interface to trusted management VLANs only and disable any WAN-side remote administration so /goform/Natlimit is not reachable from the internet (trade-off: loss of remote admin convenience). Enforce strong, unique administrator passwords and rotate credentials, since exploitation requires PR:L - credential hygiene materially reduces exposure. Where feasible on aging SOHO hardware without a forthcoming fix, plan device replacement, as embedded routers without active firmware support frequently accumulate similar stack overflows.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today