Which versions of Tenda are affected by CVE-2026-5990?

CVE-2026-5990 is a stack-based buffer overflow in Tenda F451 routers (firmware 1.0.0.7) that allows authenticated users to execute arbitrary code or disable the device entirely.

How to fix or mitigate CVE-2026-5990?

Within 24 hours: Identify all Tenda F451 routers in your environment and document firmware versions via admin interface or device inventory tools. Within 7 days: Contact Tenda support for firmware update availability and interim mitigations; restrict admin access to trusted personnel only and disable remote management if enabled. Within 30 days: Apply vendor-released firmware patch immediately upon availability; if no patch emerges, consider replacement of affected devices or network segmentation to limit lateral movement from compromised routers.

Tenda CVE-2026-5990

Q: What is the CVSS score of CVE-2026-5990?

CVE-2026-5990 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21242 HIGH

Buffer Overflow (CWE-119)

2026-04-10 cna@vuldb.com

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 10, 2026 - 00:22 euvd

EUVD-2026-21242

Analysis Generated

Apr 10, 2026 - 00:22 vuln.today

CVE Published

Apr 10, 2026 - 00:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda F451 1.0.0.7. Affected by this vulnerability is the function fromSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7 allows authenticated remote attackers to execute arbitrary code or cause denial of service via crafted 'page' parameter in the fromSafeEmailFilter function at /goform/SafeEmailFilter endpoint. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling complete compromise of device confidentiality, integrity, and availability.

Technical ContextAI

CWE-119 memory corruption vulnerability in SafeEmailFilter email filtering module. Insufficient bounds checking on user-supplied 'page' parameter enables stack memory overwrite. CVSS vector PR:L indicates low-privilege authentication requirement; network-accessible attack surface (AV:N) with low complexity (AC:L) exploitation. CPE would be cpe:2.3:o:tenda:f451_firmware:1.0.0.7.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published a security advisory or updated firmware for F451 addressing this vulnerability per available references. Recommended immediate mitigations: disable remote administrative access to /goform endpoints, restrict router management interface to trusted internal networks only, implement network-level access controls blocking external access to administrative functions. Monitor vendor site https://www.tenda.com.cn/ for future firmware updates. Consider replacing device if vendor does not release patch within acceptable risk timeframe. Technical details and proof-of-concept available at https://github.com/Jimi-Lab/cve/issues/8 and https://vuldb.com/vuln/356544 for validation testing in isolated environments.