EUVD-2026-21239
GHSA-gg8x-v42q-jxpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Tenda F451 router
-
DeliverySend crafted HTTP request to /goform/RouteStatic
-
ExploitManipulate page parameter with oversized payload
-
ExecutionTrigger stack-based buffer overflow
-
ImpactExecute arbitrary code with router privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to Tenda F451 router (firmware 1.0.0.7). Attacker with valid login credentials must send a crafted request to /goform/RouteStatic endpoint with manipulated 'page' parameter to trigger stack-based buffer overflow. Remote exploitation requires network access to router web interface. |
| Impact | CVSS 8.8 with high impact across confidentiality, integrity, and availability. Unauthenticated remote exploitation requires low complexity. Publicly available exploit code exists. Tenda F451 router firmware lacks patching mechanisms, making this broadly exploitable in deployed networks. Priority driven by network access implications and absence of mitigating controls in consumer-grade hardware. |
| Exploit ScenarioDerived | Attacker sends crafted HTTP request to /goform/RouteStatic endpoint with oversized page parameter. Stack buffer overflow overwrites return address, enabling arbitrary code execution on router. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Stack-based buffer overflow in Tenda F451 wireless router firmware 1.0.0.7 allows authenticated remote attackers to execute arbitrary code via crafted page parameter to fromRouteStatic function in /goform/RouteStatic endpoint. Attack requires low-privilege authenticated access to web management interface with no user interaction. Publicly available exploit code exists. Exploitation yields complete compromise of router confidentiality, integrity, and availability.
RemediationAI
No vendor-released patch identified at time of analysis. Tenda has not published security advisories or firmware updates addressing CVE-2026-5989 per available vendor references (https://www.tenda.com.cn/). Immediate mitigations: restrict administrative interface access to trusted networks only via firewall rules; disable remote management if enabled; implement strong authentication credentials; monitor for unauthorized configuration changes. Consider hardware replacement if vendor does not release patched firmware. Consult VulDB tracking page for updates: https://vuldb.com/vuln/356543. Organizations should isolate affected devices from untrusted networks until remediation becomes available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 stack overflow in fromRouteStatic route handling function. Insufficient bounds checking on page argument permits memory corruption beyond stack buffer boundary. CVSS vector PR:L indicates authentication required; network-accessible attack surface through HTTP management interface. Exploit primitive disclosed in public repository.
Know when F451 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Tenda F451 1.0.0.7. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
Executive ViewAI
CVE-2026-5989 is a high-severity buffer overflow in Tenda F451 router firmware (version 1.0.0.7) that allows authenticated users with low-privilege web management access to execute arbitrary code and achieve complete device compromise. Organizations deploying this router model face risk of network segmentation bypass, credential theft, and lateral movement if an insider or compromised account exploits this vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to router web management interface via host-based firewall rules and VLAN segmentation; (2) Disable HTTP/HTTPS management access from untrusted networks; (3) Enforce strong administrative credentials and multi-factor authentication where supported; (4) Monitor for anomalous outbound traffic from router; (5) Monitor Tenda security advisories for patched firmware releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
OS command injection in Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) allows remote attackers with low-privileged we
Stack-based buffer overflow in the Tenda F451 router (firmware 1.0.0.7 and 1.0.0.9) Web Management Interface allows remo
Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7 enables authenticated remote attackers to execute arbi
Buffer overflow in Tenda F451 router firmware 1.0.0.7_cn_svn7958 allows authenticated remote attackers to achieve comple
Buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to achieve arbit
Remote buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated attackers to achieve arbit
Stack-based buffer overflow in Tenda F451 wireless router (firmware 1.0.0.7_cn_svn7958) allows authenticated remote atta
Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7_cn_svn7958 allows authenticated remote attacke
Stack-based buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to a
Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7 allows authenticated remote attackers to achieve compl
Stack-based buffer overflow in Tenda F451 router version 1.0.0.7 allows authenticated remote attackers to execute arbitr
Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7 allows authenticated remote attackers to achie
Exploit-DB