What is the CVSS score of CVE-2026-36785?

CVE-2026-36785 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda FH451 are affected by CVE-2026-36785?

Organizations deploying Tenda FH451 routers (firmware 1.0.0.9) face remote denial-of-service risk with publicly available exploit code-unauthenticated attackers can crash devices and disrupt network…

How to fix or mitigate CVE-2026-36785?

Within 24 hours: Inventory all Tenda FH451 V1.0.0.9 devices in network infrastructure and assess exposure in production environments. Within 7 days: Evaluate replacement hardware options and contact Tenda for firmware updates or interim workaround availability. Within 30 days: Replace affected routers with alternative equipment or implement network-level compensating controls (rate-limiting, segmentation, HTTP access restrictions).

Tenda FH451 CVE-2026-36785

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-05 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:25 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the page parameter of the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda FH451 V1.0.0.9 routers allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack overflow in the page parameter handler of the fromDhcpListClient function. EPSS exploitation probability is very low (0.01%, 3rd percentile) and no public exploit identified at time of analysis, though proof-of-concept artifacts appear to be hosted in a public GitHub research repository. The flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in the web management interface of the Tenda FH451, a SOHO-class enterprise/SMB router from Shenzhen Tenda Technology. The fromDhcpListClient function is one of the handlers in the device's embedded HTTP server (typically the httpd/goahead-derived binary common to Tenda firmware) that processes administrative pages such as the DHCP client list. CWE-121 (Stack-based Buffer Overflow) indicates that the page parameter received via HTTP is copied into a fixed-size stack buffer without proper length validation, corrupting the stack frame and crashing the binary. Because consumer/SMB router firmware typically lacks modern mitigations (ASLR, stack canaries are inconsistently applied on MIPS/ARM embedded targets), stack overflows in Tenda devices have historically been escalatable beyond DoS, although this specific CVE is scored only for availability impact.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory in the supplied references. Until a firmware update for the FH451 is released, restrict access to the router's web management interface by disabling remote/WAN management entirely and limiting LAN-side access to a dedicated management VLAN or specific admin IP addresses via ACLs - this directly removes the network reachability required by the AV:N vector at the cost of administrator convenience. Monitor the Tenda support portal (https://www.tendacn.com) for an FH451 firmware release superseding V1.0.0.9, and consult the researcher repository at https://github.com/xhh0124/SemVulLLM/tree/main/FH451/fromDhcpListClient_0 for additional technical detail. For high-exposure deployments, consider replacing end-of-support consumer-grade hardware with devices that receive regular security maintenance, since Tenda SMB routers have a long history of similar unpatched buffer overflows.