EUVD-2026-35118
GHSA-5jh4-mg5m-84h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Tenda FH451 web interface
-
DeliveryCraft HTTP request with oversized list1 parameter
-
ExploitSend to fromDhcpListClient endpoint
-
ExecutionOverflow stack buffer in httpd
-
PersistCrash management process and trigger device reboot
-
ImpactSustained denial of service via repeated requests
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to the Tenda FH451 V1.0.0.9 web management interface (TCP port 80 by default) and the ability to send a crafted HTTP request invoking the fromDhcpListClient handler with an oversized list1 parameter - no authentication, user interaction, or non-default configuration is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Realistic exploitation is limited by the fact that FH451 management is typically bound to the LAN interface unless 'Remote Web Management' is explicitly enabled by the operator, so internet-facing exploitation requires either that toggle being on or the attacker already having LAN/Wi-Fi access; impact is also bounded to availability (A:H, C:N, I:N), so the bug enables disruption but not code execution or data theft from the available evidence. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a remote, unauthenticated, low-complexity attack with high availability impact only - consistent with the description of a DoS-class stack overflow. There is no EPSS score, no KEV listing, and no evidence of in-the-wild abuse, so real-world priority is moderate rather than urgent: the device is consumer-grade and typically not directly internet-exposed on its WAN-side management interface by default, which limits the addressable population. The published GitHub artifact under SemVulLLM appears to be academic/LLM-assisted vulnerability research rather than a weaponized exploit, but it does provide a reproducible trigger. CPE data is uninformative ('n/a:n/a'), and EUVD lists affected versions only as 'n/a' - so beyond the description's explicit FH451 V1.0.0.9 designation, the exact scope of affected firmware builds is not independently confirmed. |
| Exploit ScenarioDerived | An attacker on the same LAN segment (or reachable across the WAN if remote management is enabled) sends a single crafted HTTP request to the router's web interface with an oversized list1 parameter targeting the fromDhcpListClient endpoint. The httpd process overflows its stack buffer and crashes, taking the management plane - and on many Tenda builds, the routing/NAT data plane - offline until the device watchdog reboots it. A reproduction artifact is published in the SemVulLLM GitHub repository, lowering the effort required to weaponize the bug for repeated disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Denial of service in Tenda FH451 router firmware V1.0.0.9 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack overflow in the list1 parameter of the fromDhcpListClient function. Publicly available exploit code exists in a GitHub research repository, though the vulnerability is not listed in CISA KEV and no EPSS score has been published at time of analysis. Impact is limited to availability - no confidentiality or integrity loss is indicated.
RemediationAI
No vendor-released patch identified at time of analysis - Shenzhen Tenda has not published an advisory or fixed firmware build referenced in the provided intelligence, so administrators should monitor https://www.tendacn.com for an updated FH451 firmware image superseding V1.0.0.9. As compensating controls, restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin IPs (most FH-series devices expose this on LAN by default but support ACLs), and ensure remote/WAN-side web administration is disabled - the trade-off is loss of off-LAN management convenience. Where feasible, place the device behind an upstream firewall that blocks unsolicited HTTP/HTTPS to the router's management port, and consider replacement with a supported model if no firmware update materializes, since EOL SOHO routers commonly accumulate similar form-handler overflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda FH451 is a small office/home office (SOHO) wired router, and the affected fromDhcpListClient routine is part of its web management interface, which exposes DHCP client list handling over HTTP. The root cause is CWE-121 (Stack-based Buffer Overflow): the list1 query/POST parameter is copied into a fixed-size stack buffer without adequate bounds checking, so an oversized value corrupts the call stack and crashes the httpd process. This pattern is recurrent across Tenda's MIPS-based residential firmware family, where multiple form-handler functions historically lack length validation on user-controlled HTTP parameters.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 parameter of the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
Tenda FH451 router firmware V1.0.0.9 is vulnerable to remote denial-of-service attacks from unauthenticated sources, allowing attackers to crash the device and disrupt network operations. Publicly available exploit code exists for this vulnerability. With no vendor patch currently available, organizations using this router model must implement immediate mitigation controls to protect network availability.
No vendor-released patch identified at time of analysis. Implement network segmentation to isolate affected routers from untrusted networks. Deploy firewall or IPS rules to filter HTTP requests targeting the vulnerable list1 parameter. Disable DHCP list functionality where operationally feasible. Monitor device availability for unexpected crashes and maintain hardware replacement inventory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB