F451 CVE-2026-6124

Authenticated attacker with login access to Tenda F451 router (firmware 1.0.0.7) httpd interface. Remote exploitation via POST to /goform/SafeMacFilter endpoint by manipulating 'page' or 'menufacturer' parameter to trigger stack-based buffer overflow in fromSafeMacFilter function.

Real-world risk is CRITICALLY HIGH despite requiring authentication (PR:L). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible exploitation with low attack complexity, requiring only low-privilege credentials (often default or weak admin passwords on consumer routers). The availability of public exploit code (GitHub POC at https://github.com/Jimi-Lab/cve/issues/16) dramatically increases exploitation likelihood, as attackers can weaponize the POC with minimal effort. While EPSS data is not provided, similar router vulnerabilities with public exploits typically see EPSS scores above 0.50 (50% probability of exploitation within 30 days). No CISA KEV listing suggests mass exploitation campaigns have not yet occurred, but the combination of public exploit, network attack vector, and widespread deployment of consumer routers creates significant risk for credential stuffing or brute-force attacks followed by exploitation. SSVC decision points: Exploitation=POC, Automatable=Yes (requires only credential discovery), Technical Impact=Total (arbitrary code execution). This is NOT a theoretical risk-attackers routinely target consumer routers for botnet recruitment, lateral movement into home/office networks, and traffic interception. Organizations using Tenda F451 devices should treat this as an emergency patch scenario.

An attacker scans internet-facing IP ranges identifying Tenda F451 routers via HTTP banner fingerprinting on port 80/443. Using credential stuffing with common default passwords (admin/admin) or exploiting weak passwords via brute force, the attacker authenticates to the web management interface. The attacker then crafts a malicious HTTP POST request to /goform/SafeMacFilter with oversized 'page' or 'menufacturer' parameter values containing shellcode. The fromSafeMacFilter function copies this input to a stack buffer without bounds checking, triggering a buffer overflow that overwrites the function's return address. Upon function return, execution redirects to attacker-controlled shellcode, granting root-level command execution on the router's embedded Linux system. The attacker installs persistent backdoor access, joins the device to a botnet, or pivots into the internal network behind the router.