Which versions of Tenda are affected by CVE-2026-5988?

CVE-2026-5988 is a stack-based buffer overflow in Tenda F451 wireless router firmware 1.0.0.7 that allows authenticated users with low-privilege access to execute arbitrary code and gain complete…

How to fix or mitigate CVE-2026-5988?

Within 24 hours: Inventory all Tenda F451 devices running firmware 1.0.0.7 and restrict web management interface access to trusted IP addresses only via firewall rules. Within 7 days: Disable remote management features and implement network segmentation to isolate affected routers from critical infrastructure. Within 30 days: Contact Tenda for firmware updates or plan replacement of F451 units with alternative router models from vendors with active security support; test any available firmware patches in a controlled environment before production deployment.

Tenda CVE-2026-5988

Q: What is the CVSS score of CVE-2026-5988?

CVE-2026-5988 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21238 HIGH

Buffer Overflow (CWE-119)

2026-04-09 cna@vuldb.com

GHSA-wmj6-9qv3-c38f

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 09, 2026 - 23:22 euvd

EUVD-2026-21238

Analysis Generated

Apr 09, 2026 - 23:22 vuln.today

CVE Published

Apr 09, 2026 - 23:17 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 wireless router firmware 1.0.0.7 enables authenticated remote attackers to execute arbitrary code via crafted mit_ssid parameter to formWrlsafeset function in /goform/AdvSetWrlsafeset endpoint. Publicly available exploit code exists. Attack requires low-privilege authenticated access to the router's web management interface, resulting in complete compromise of device confidentiality, integrity, and availability with no impact to other network segments.

Technical ContextAI

Insufficient input validation in formWrlsafeset wireless security configuration handler allows stack memory corruption through oversized mit_ssid parameter. CWE-119 memory buffer error permits direct manipulation of return addresses and execution flow. Affects CPE cpe:2.3:o:tenda:f451_firmware:1.0.0.7:*:*:*:*:*:*:*. CVSS vector PR:L indicates authenticated exploitation requirement; no local attack complexity.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published security advisories addressing CVE-2026-5988 per manufacturer website https://www.tenda.com.cn/. Immediate mitigations: (1) disable remote management access to administrative interface, restrict access to trusted local network segments only; (2) implement network segmentation isolating F451 devices from critical infrastructure; (3) monitor authentication logs for unauthorized access attempts to /goform endpoints; (4) consider device replacement with actively supported hardware if vendor does not release firmware update. Vulnerability details: https://vuldb.com/vuln/356542 and proof-of-concept: https://github.com/Jimi-Lab/cve/issues/4. Contact Tenda technical support for patch availability status.