Which versions of Tenda are affected by CVE-2026-6133?

Tenda F451 routers running version 1.0.0.7_cn_svn7958 contain a stack-based buffer overflow vulnerability allowing authenticated attackers to execute arbitrary code with full system compromise.

Is there a public PoC exploit available for CVE-2026-6133?

Yes, a public proof-of-concept exploit is available for CVE-2026-6133. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6133?

Within 24 hours: Inventory all Tenda F451 routers in your environment and identify version 1.0.0.7_cn_svn7958 deployments; verify authentication control strength on affected device web interfaces. Within 7 days: Implement network-level access restrictions to the /goform/SafeUrlFilter endpoint and restrict administrative access to router management interfaces to trusted IP ranges only. Within 30 days: Contact Tenda for patch availability and timeline; evaluate replacement with alternative router solutions from vendors with active security support if no patch timeline is provided.

Tenda CVE-2026-6133

Q: What is the CVSS score of CVE-2026-6133?

CVE-2026-6133 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21750 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

Tenda Stack Overflow Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 12:38 vuln.today

Public exploit code

CVSS changed

Apr 12, 2026 - 23:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 23:11 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 23:00 euvd

EUVD-2026-21750

Analysis Generated

Apr 12, 2026 - 23:00 vuln.today

CVE Published

Apr 12, 2026 - 22:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. This affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability resides in the fromSafeUrlFilter function handling the 'page' parameter in /goform/SafeUrlFilter endpoint. Publicly available exploit code exists (GitHub POC), significantly lowering exploitation barrier. With CVSS 8.8 (Critical) and low attack complexity, this represents a serious risk to deployed devices, though exploitation requires authenticated access (PR:L) to the router's web interface.

Technical ContextAI

The vulnerability is a classic stack-based buffer overflow (CWE-121) in Tenda F451 wireless router firmware. The affected component is the fromSafeUrlFilter function within the /goform/SafeUrlFilter endpoint, which processes URL filtering configurations in the router's web management interface. When processing the 'page' argument, insufficient bounds checking allows an attacker to write beyond allocated stack buffer boundaries. Stack-based overflows are particularly dangerous in embedded devices like SOHO routers because they typically lack modern memory protection mechanisms (ASLR, DEP/NX) common in desktop operating systems. The CPE identifier (cpe:2.3:a:tenda:f451:*:*:*:*:*:*:*:*) confirms this affects Tenda F451 router firmware. Given the specific build identifier (7958), this appears to be a China-region firmware variant. The network-accessible attack vector (AV:N) combined with router context means successful exploitation could enable network-level attacks including traffic interception, DNS hijacking, or pivot points for internal network compromise.

RemediationAI

No vendor-released patch identified at time of analysis. The Tenda website (https://www.tenda.com.cn/) should be monitored for firmware updates, though Tenda's historical track record on security patches for older devices is poor. In the absence of a patch, implement defense-in-depth mitigations: (1) Disable remote management access to the router's web interface, ensuring administrative access is only possible from the local LAN; (2) Change default credentials immediately to strong, unique passwords (minimum 16 characters, alphanumeric with symbols); (3) If the SafeUrlFilter feature is not required, disable it through router configuration to eliminate the attack surface; (4) Place the router behind a more secure edge device if possible, or segment vulnerable IoT/router devices into isolated network zones; (5) Monitor Tenda security advisories and third-party vulnerability databases for patch availability; (6) Consider hardware replacement with a router from a vendor with better security support lifecycle, as end-of-life devices rarely receive patches. The VulDB references (https://vuldb.com/vuln/356997) may provide additional technical details or community-developed mitigations.