F451 CVE-2026-6121

Tenda F451 firmware version 1.0.0.7. Attacker requires authenticated access to the device's web interface (PR:L). Exploit targets the WrlclientSet function via /goform/WrlclientSet endpoint with malicious GO parameter causing stack-based buffer overflow. Remote exploitation possible via HTTP.

Real-world risk is HIGH for deployed Tenda F451 routers, though targeting requires authentication. The CVSS base score of 8.8 reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L). The temporal score modifier E:P confirms proof-of-concept exploit code exists, which GitHub references verify. While no CISA KEV listing indicates active exploitation campaigns, the combination of public exploit code, network-accessible attack surface, and IoT device attack vector creates significant risk. EPSS data not provided, but typical router vulnerabilities with public POCs see elevated exploitation probability. The requirement for low-privilege authentication (PR:L) provides minimal security boundary, as default credentials and credential stuffing are common against consumer routers. SSVC assessment suggests DEFER or ACT depending on exposure: exploitation is PROVEN (POC public), likely AUTOMATABLE given simple parameter manipulation, and TOTAL technical impact (system compromise). Consumer routers rarely receive timely patches, extending exposure windows indefinitely for many deployments.

An attacker who has obtained low-privilege credentials (through credential stuffing, default password exploitation, or previous compromise) authenticates to the Tenda F451 web administration interface from the internet or local network. They craft a malicious HTTP POST request to the /goform/WrlclientSet endpoint with an oversized 'GO' parameter designed to overflow the stack buffer in the WrlclientSet function. The overflow overwrites the function return address with attacker-controlled values, redirecting execution to shellcode embedded in the request payload. Upon function return, the httpd service executes the attacker's code with root privileges, granting complete control over the router to install persistent backdoors, intercept network traffic, pivot to internal network resources, or recruit the device into a botnet.