Which versions of Tenda are affected by CVE-2026-4534?

Tenda FH451 routers running firmware 1.0.0.9 contain a critical remote code execution vulnerability that attackers can exploit with publicly available tools, potentially giving them complete control…

Is there a public PoC exploit available for CVE-2026-4534?

Yes, a public proof-of-concept exploit is available for CVE-2026-4534. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4534?

Within 24 hours: Inventory all Tenda FH451 devices in your environment and restrict administrative access to the /goform/WrlExtraSet endpoint via firewall rules. Within 7 days: Isolate affected routers to a separate management network and disable remote administration features if business operations permit. Within 30 days: Plan replacement of vulnerable devices with alternative network equipment from vendors with active security support, or contact Tenda for emergency firmware updates.

Tenda CVE-2026-4534

Q: What is the CVSS score of CVE-2026-4534?

CVE-2026-4534 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14281 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-22 VulDB

GHSA-97m6-jj73-c64q

Buffer Overflow Stack Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 17:23 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 04:30 euvd

EUVD-2026-14281

Analysis Generated

Mar 22, 2026 - 04:30 vuln.today

CVE Published

Mar 22, 2026 - 03:32 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

Stack overflow in Tenda FH451 firmware version 1.0.0.9 allows authenticated remote attackers to execute arbitrary code through improper input validation in the WrlExtraSet function. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw requires network access and valid credentials but can completely compromise the affected device's confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the Tenda FH451 wireless router (CPE: cpe:2.3:a:tenda:fh451:*:*:*:*:*:*:*:*), specifically firmware version 1.0.0.9. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the formWrlExtraSet function which handles wireless extra settings through the /goform/WrlExtraSet endpoint. When processing the 'GO' parameter, insufficient bounds checking allows an attacker to write beyond the allocated buffer on the stack, potentially overwriting return addresses or other critical memory structures. This class of vulnerability is particularly dangerous in embedded devices like routers where memory protections may be limited or absent, and successful exploitation can lead to complete device compromise.

RemediationAI

No official patch or firmware update from Tenda has been identified in the available references for this vulnerability. Users of Tenda FH451 firmware version 1.0.0.9 should immediately check the vendor website at https://www.tenda.com.cn/ for any firmware updates beyond version 1.0.0.9 and apply them if available. As interim mitigations until patching is possible, restrict administrative access to the router to trusted IP addresses only, change default credentials to strong unique passwords, disable remote management interfaces if not required, and place affected devices behind additional network security controls such as firewalls that can filter access to the /goform/ endpoints. Organizations should consider replacing these devices with alternative models if vendor support and patching proves unavailable, given the public availability of exploit code.