Which versions of Tenda are affected by CVE-2026-6124?

CVE-2026-6124 is a critical remote code execution vulnerability affecting Tenda F451 routers (firmware 1.0.0.7) that allows authenticated users to completely compromise the device through a stack…

Is there a public PoC exploit available for CVE-2026-6124?

Yes, a public proof-of-concept exploit is available for CVE-2026-6124. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6124?

Within 24 hours: Identify and inventory all Tenda F451 devices running firmware 1.0.0.7 using network scanning tools; immediately revoke or rotate credentials for any administrative accounts with router access. Within 7 days: Isolate affected Tenda F451 devices to segregated network segments with restricted access controls; check Tenda security advisories for firmware updates beyond 1.0.0.7. Within 30 days: Replace Tenda F451 devices with alternative vendor equipment or implement compensating controls (see below); conduct network forensics on affected devices for unauthorized access indicators.

Tenda CVE-2026-6124

Q: What is the CVSS score of CVE-2026-6124?

CVE-2026-6124 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21726 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

GHSA-hjj3-4fc4-rhvw

Tenda Stack Overflow Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:07 vuln.today

cvss_changed

PoC Detected

Apr 29, 2026 - 19:54 vuln.today

Public exploit code

CVSS changed

Apr 12, 2026 - 09:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 09:21 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 09:15 euvd

EUVD-2026-21726

Analysis Generated

Apr 12, 2026 - 09:15 vuln.today

CVE Published

Apr 12, 2026 - 09:00 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router firmware 1.0.0.7 allows authenticated remote attackers to achieve complete system compromise via the SafeMacFilter function. The vulnerability is exploitable over the network with low complexity, requiring only basic user credentials. Publicly available exploit code exists (GitHub POC), significantly lowering the barrier for exploitation. CVSS 8.8 (High) severity with potential for code execution, data theft, and device takeover.

Technical ContextAI

This vulnerability resides in the httpd daemon of Tenda F451 wireless router firmware version 1.0.0.7, specifically within the fromSafeMacFilter function handling requests to /goform/SafeMacFilter. The root cause is CWE-121 (stack-based buffer overflow), where user-controlled input from the 'page' and 'menufacturer' parameters is copied to a fixed-size stack buffer without proper bounds checking. When oversized input exceeds the buffer capacity, adjacent stack memory is corrupted, enabling control of the return address and arbitrary code execution. This is a classic memory safety vulnerability common in legacy embedded device firmware written in C/C++ without modern compiler protections. The affected CPE is cpe:2.3:a:tenda:f451:*:*:*:*:*:*:*:*, indicating all versions of the F451 product line may be vulnerable, though the specific vulnerable version confirmed is 1.0.0.7. The httpd component processes web-based administrative requests, making network-accessible administrative interfaces the primary attack surface.

RemediationAI

No vendor-released patch identified at time of analysis-Tenda has not published updated firmware or a security advisory for CVE-2026-6124. Immediate interim mitigations are critical: (1) Disable remote administration access to the web interface if not operationally required, restricting management to trusted LAN segments only. (2) Change default administrative credentials to strong, unique passwords (20+ characters) to prevent credential-based initial access. (3) Implement network segmentation placing the router's management interface behind firewall ACLs accessible only from dedicated management VLANs. (4) Monitor Tenda's official support site (https://www.tenda.com.cn/) for firmware updates, though vendor responsiveness to security issues in legacy consumer products is historically poor. (5) Consider replacing affected devices with actively supported alternatives if vendor does not release a patch within a reasonable timeframe (30-60 days). Organizations should review VulDB entries (https://vuldb.com/vuln/356987) for community-identified workarounds. Given the lack of vendor response and availability of public exploits, device replacement may be the most viable long-term remediation strategy.