Which versions of Tenda are affected by CVE-2026-5045?

CVE-2026-5045 is a critical remote code execution vulnerability in Tenda FH1201 routers (v1.2.0.14) that allows authenticated users with low-privilege network access to completely compromise affected…

Is there a public PoC exploit available for CVE-2026-5045?

Yes, a public proof-of-concept exploit is available for CVE-2026-5045. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5045?

Within 24 hours: Inventory all Tenda FH1201 routers in production and document affected versions; confirm whether low-privilege user accounts exist on these devices. Within 7 days: Implement network segmentation to restrict administrative access to affected routers (disable WAN-side access, enforce VPN-only administration); consider disconnecting non-critical affected units pending replacement. Within 30 days: Replace all vulnerable Tenda FH1201 v1.2.0.14 units with vendor-patched firmware versions (when released) or alternative router models; if replacement is unavailable, maintain offline backups and monitor for suspicious administrative activity.

Tenda CVE-2026-5045

Q: What is the CVSS score of CVE-2026-5045?

CVE-2026-5045 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17031 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-29 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 15:46 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 13:45 euvd

EUVD-2026-17031

Analysis Generated

Mar 29, 2026 - 13:45 vuln.today

CVE Published

Mar 29, 2026 - 13:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda FH1201 router (v1.2.0.14) enables remote authenticated attackers to execute arbitrary code via the WrlclientSet function. Exploitation requires only low-privilege credentials (CVSS PR:L) and has low attack complexity (AC:L), with publicly available exploit code on GitHub. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No vendor patch identified at time of analysis, creating urgent risk for deployed devices.

Technical ContextAI

This vulnerability affects the WrlclientSet function within the /goform/WrlclientSet endpoint of the Tenda FH1201 wireless router's web-based parameter handler. The flaw is a CWE-121 stack-based buffer overflow triggered by insufficient input validation on the 'GO' parameter. When processing this parameter, the application copies user-controlled data to a fixed-size stack buffer without proper boundary checks, allowing an attacker to overwrite adjacent memory including return addresses. The affected product is identified as cpe:2.3:a:tenda:fh1201:*:*:*:*:*:*:*:* running firmware version 1.2.0.14(408). Stack-based buffer overflows in embedded device web interfaces are particularly dangerous because they typically run with elevated privileges and may bypass modern exploit mitigations common in desktop operating systems.

RemediationAI

No vendor-released patch identified at time of analysis based on available references. Primary mitigation requires restricting network access to the router's administrative interface: disable remote management features, implement strict firewall rules allowing admin access only from trusted internal IP addresses, and change default credentials to complex unique passwords. Consider replacing affected Tenda FH1201 devices with alternative router models from vendors with active security support programs if firmware updates are not forthcoming. Monitor the vendor security page at https://www.tenda.com.cn/ and VulDB tracking page https://vuldb.com/vuln/353968 for potential future patches. Network segmentation isolating IoT/router management interfaces from general user networks reduces lateral movement risk post-compromise. Given the public exploit at https://github.com/Litengzheng/vul_db/blob/main/FH1201/vul_43/README.md, organizations should treat all exposed FH1201 devices as high-priority remediation targets.