EUVD-2026-21246
GHSA-x2v6-6w2m-gj34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Tenda F451 device
-
ExploitSend crafted P2pListFilter request with oversized page parameter
-
ExecutionTrigger stack-based buffer overflow in fromP2pListFilter function
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to Tenda F451 router (firmware 1.0.0.7). Attacker must be logged into the device web interface to send malicious 'page' parameter to /goform/P2pListFilter endpoint, triggering stack-based buffer overflow. |
| Impact | CVSS 7.4 reflects high confidentiality and integrity impact on authenticated systems. Publicly available exploit code exists for this stack-based buffer overflow in Tenda F451 router firmware. Blast radius limited to organizations running vulnerable firmware versions with network access to affected devices. Priority depends on deployment scope and whether attackers can obtain legitimate credentials. |
| Exploit ScenarioDerived | Attacker with valid router credentials sends crafted HTTP POST request to /goform/P2pListFilter with oversized page parameter, triggering stack buffer overflow. Publicly available exploit code exists; no kernel-level mitigations prevent code execution once authentication is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Stack-based buffer overflow in Tenda F451 router (version 1.0.0.7) enables authenticated remote attackers to execute arbitrary code via malformed 'page' parameter in fromP2pListFilter function at /goform/P2pListFilter endpoint. Publicly available exploit code exists. Attack requires low-privilege authentication (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact on vulnerable device.
RemediationAI
No vendor-released patch identified at time of analysis. Tenda has not published security advisories addressing CVE-2026-5992 on official support channels (https://www.tenda.com.cn/). Recommended immediate mitigations: disable remote administration interfaces, restrict administrative access to trusted internal networks only via firewall rules, implement network segmentation isolating IoT devices. Monitor vendor advisory page for future firmware updates. Consider replacing device if vendor does not issue patch within reasonable timeframe, as publicly disclosed exploit increases attack likelihood. VulDB tracking: https://vuldb.com/vuln/356546
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 buffer overflow in fromP2pListFilter function fails to validate 'page' parameter length before stack copy operation. CVSS 4.0 vector indicates network-accessible attack surface with low complexity (AC:L, AT:N). Affects embedded router firmware without modern memory protections typical of SOHO devices.
Know when F451 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in Tenda F451 1.0.0.7. This affects the function fromP2pListFilter of the file /goform/P2pListFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
CVE-2026-5992 is a stack-based buffer overflow affecting Tenda F451 routers (v1.0.0.7) that allows authenticated attackers with low-privilege access to execute arbitrary code and potentially compromise network infrastructure. Organizations deploying this router model face risk of unauthorized device takeover, data interception, and network disruption without immediate vendor remediation available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict unauthenticated access to router web interface via firewall/WAF; (2) Disable low-privilege user accounts where possible; (3) Implement network segmentation to isolate router from critical systems; (4) Enable detailed logging on router access attempts; (5) Monitor for firmware update availability from Tenda; (6) Consider temporary replacement with patched alternative router models for high-risk network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Tenda F451 Buffer Overflow Vulnerabilities
View all 3More in F451 Firmware
View allRemote code execution in Tenda FH451 firmware via stack-based buffer overflow in the QuickIndex function allows unauthen
Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7_cn_svn7958 allows authenticated remote attackers to ac
Stack-based buffer overflow in Tenda F451 wireless router firmware 1.0.0.7 enables authenticated remote attackers to exe
Exploit-DB