Which versions of Tenda are affected by CVE-2026-6120?

Tenda F451 routers (version 1.0.0.7) contain a stack-based buffer overflow vulnerability in the DHCP client management function that allows authenticated attackers to achieve complete system…

Is there a public PoC exploit available for CVE-2026-6120?

Yes, a public proof-of-concept exploit is available for CVE-2026-6120. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6120?

Within 24 hours: Identify all Tenda F451 v1.0.0.7 devices in inventory and restrict network access to the httpd service (port 80/443) to trusted administrative IP ranges only. Within 7 days: Disable or restrict access to the /goform/DhcpListClient endpoint through firewall rules or WAF policies if possible; audit administrative account credentials for evidence of compromise. Within 30 days: Plan and execute replacement of Tenda F451 v1.0.0.7 units with alternative router hardware or contact Tenda for guidance on firmware alternatives, as no vendor patch is currently available.

Tenda CVE-2026-6120

Q: What is the CVSS score of CVE-2026-6120?

CVE-2026-6120 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21718 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

GHSA-frh5-x99h-w9g9

Stack Overflow Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:07 vuln.today

cvss_changed

PoC Detected

Apr 29, 2026 - 20:02 vuln.today

Public exploit code

CVSS changed

Apr 12, 2026 - 06:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 06:20 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 06:15 euvd

EUVD-2026-21718

Analysis Generated

Apr 12, 2026 - 06:15 vuln.today

CVE Published

Apr 12, 2026 - 06:00 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda F451 1.0.0.7. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router version 1.0.0.7 allows authenticated remote attackers to achieve complete system compromise through the DHCP client list function. The vulnerability exists in the httpd service's /goform/DhcpListClient endpoint via the 'page' parameter. Publicly available exploit code exists (GitHub POC published), enabling low-complexity attacks that can result in full confidentiality, integrity, and availability compromise. CVSS 8.8 reflects high impact across all security objectives with minimal attack complexity, though low-privileged authentication is required.

Technical ContextAI

This vulnerability affects the httpd daemon in Tenda F451 wireless router firmware 1.0.0.7, specifically within the fromDhcpListClient function that processes DHCP client list requests. The flaw is a CWE-121 stack-based buffer overflow, occurring when the application fails to properly validate the length of user-supplied input to the 'page' parameter before copying it to a fixed-size stack buffer. Stack-based overflows are particularly dangerous in embedded devices like routers because they can overwrite return addresses and function pointers stored on the stack, allowing attackers to redirect execution flow. The affected CPE (cpe:2.3:a:tenda:f451) identifies this as an application-level vulnerability in Tenda's router firmware. The httpd service typically runs with elevated privileges on embedded devices, making successful exploitation highly impactful. The network-accessible attack vector (AV:N) combined with the DHCP management interface location (/goform/DhcpListClient) indicates this is a web-based administrative function vulnerable through the router's management interface.

RemediationAI

Users of Tenda F451 routers should immediately check their current firmware version and monitor Tenda's official security advisory page at https://www.tenda.com.cn/ for updated firmware releases addressing CVE-2026-6120. No vendor-released patch version has been independently confirmed at time of analysis based on available references. Until a patched firmware version is released and deployed, implement compensating controls including restricting administrative interface access to trusted IP addresses only, changing default administrative credentials to strong unique passwords, disabling remote management features if not required, and placing affected devices behind additional network segmentation or firewall rules that limit access to the management interface from untrusted networks. Organizations should consider replacing affected devices with alternative router models if vendor support appears discontinued or patches are not released within an acceptable timeframe. Monitor VulDB references (https://vuldb.com/vuln/356983) and the vendor website for patch availability updates.