F451 CVE-2026-6123

Authenticated user access to Tenda F451 router (version 1.0.0.7) httpd service. Attacker must send crafted request manipulating 'entrys' parameter to /goform/addressNat endpoint. No victim interaction required.

This vulnerability presents significant real-world risk despite requiring authentication. The CVSS base score of 8.8 (High) reflects the complete compromise potential (C:H/I:H/A:H) with network-based attack vector (AV:N) and low complexity (AC:L). Critically, public exploit code exists on GitHub, substantially lowering the skill barrier for exploitation. The CVSS temporal modifier E:P (Proof-of-concept Exploit) confirms weaponization. While PR:L (Low privileges required) provides some mitigation, default or weak credentials on consumer routers are notoriously common, making this requirement a minimal barrier. The vulnerability is NOT in CISA KEV, indicating no confirmed large-scale active exploitation campaigns at analysis time, but the combination of public exploit availability, consumer device target, and complete system compromise potential creates high risk for individual device owners. Home/SOHO routers rarely receive security monitoring, allowing persistent compromise. SSVC framework assessment: Exploitation=POC, Automatable=Yes (once authenticated), Technical Impact=Total (router compromise enables network interception, DNS manipulation, botnet enrollment). Priority should be elevated for organizations using these devices in any capacity.

An attacker identifies a Tenda F451 router exposed on a target network, either through internet scanning or by compromising a device on the local network. Using default credentials (admin/admin) or credentials obtained through phishing or previous compromise, the attacker authenticates to the router's web interface. They then send a specially crafted HTTP POST request to /goform/addressNat with an oversized 'entrys' parameter value designed to overflow the stack buffer in the fromAddressNat function. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode embedded in the request. With code execution achieved at the router's privilege level, the attacker installs persistent backdoor firmware, redirects DNS queries to malicious servers, or enrolls the device in a botnet for DDoS attacks.