What is the CVSS score of CVE-2026-3679?

CVE-2026-3679 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of F451 Firmware are affected by CVE-2026-3679?

A high-severity vulnerability (CVSS 8.8) in Tenda FH451 routers lacks available patches and has active public exploits, creating immediate risk for organizations using this device.

Is there a public PoC exploit available for CVE-2026-3679?

Yes, a public proof-of-concept exploit is available for CVE-2026-3679. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3679?

Within 24 hours: Inventory all Tenda FH451 devices in your environment and isolate affected units from critical network segments. Within 7 days: Implement network segmentation to restrict access to vulnerable devices, apply WAF rules to block malicious requests to /goform/QuickIndex endpoints, and disable remote management features if available. Within 30 days: Plan replacement of Tenda FH451 devices with alternative vendors or evaluate firmware updates if released by Tenda; establish a formal device lifecycle policy to prevent deployment of unsupported hardware.

F451 Firmware CVE-2026-3679

HIGH

Buffer Overflow (CWE-119)

2026-03-07 cna@vuldb.com

Buffer Overflow Stack Overflow F451 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:16 vuln.today

Public exploit code

CVE Published

Mar 07, 2026 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was identified in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex. Such manipulation of the argument mit_linktype/PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote code execution in Tenda FH451 firmware via stack-based buffer overflow in the QuickIndex function allows unauthenticated attackers to execute arbitrary code by sending crafted requests with oversized PPPOEPassword parameters. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and affects firmware version 1.0.0.9 and potentially other versions.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects F451 Firmware. A vulnerability was identified in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex. Such manipulation of the argument mit_linktype/PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.