F451 CVE-2026-6120

Tenda F451 firmware version 1.0.0.7. Attacker requires authenticated access to the httpd service via the /goform/DhcpListClient endpoint with the 'page' parameter. Remote exploitation requires valid login credentials.

Real-world risk assessment reveals a moderate-to-high threat profile when cross-referencing multiple signals. The CVSS 8.8 score indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and no user interaction required (UI:N), but exploitation requires low-privileged authentication (PR:L), likely administrative or authenticated LAN access. The publicly available exploit code on GitHub substantially lowers the skill barrier for attackers, making this vulnerability actionable by less sophisticated threat actors. However, the authentication requirement significantly constrains the attack surface compared to unauthenticated remote code execution vulnerabilities. No CISA KEV listing indicates this is not confirmed as actively exploited in widespread campaigns at time of analysis. EPSS data was not provided, limiting probability assessment, but the combination of public POC availability and router/IoT context suggests moderate exploitation likelihood within environments where default credentials are used or attackers have already gained initial LAN access. The SSVC exploitation status of 'Proof of Concept' (E:P in CVSS vector) confirms ready-to-use exploit code exists. Technical impact is maximum (root/system-level compromise possible on embedded device), and the vulnerability appears automatable once authentication is obtained. Priority should be high for organizations using affected Tenda F451 routers, particularly in SOHO or small business environments where these devices often operate with default configurations.

An attacker who has obtained low-privileged credentials to the Tenda F451 router's web management interface (either through credential stuffing, default password usage, or prior LAN access) connects to the administrative portal and sends a specially crafted HTTP request to the /goform/DhcpListClient endpoint with an oversized 'page' parameter value. This triggers the stack-based buffer overflow in the fromDhcpListClient function, allowing the attacker to overwrite stack memory including return addresses and execute arbitrary code with the privileges of the httpd service (typically root on embedded routers). The attacker can then establish persistent backdoor access, modify router configurations, intercept network traffic, or pivot to other devices on the internal network.