F451 CVE-2026-6134

Requires authenticated access to Tenda F451 router running firmware 1.0.0.7_cn_svn7958. Attacker must be logged into the web interface to access /goform/qossetting endpoint and manipulate the 'qos' parameter, triggering stack-based buffer overflow.

Real-world risk assessment using multi-signal analysis: The CVSS 7.4 score reflects significant severity with network-based attack vector (AV:N), low attack complexity (AC:L), and no user interaction required (UI:N), but exploitation requires low-privilege authentication (PR:L). The publicly available exploit code on GitHub (confirmed PoC status) dramatically increases exploitation likelihood by providing attackers ready-made weaponization. However, the PR:L requirement means attackers need valid router credentials, likely obtained through default credentials, credential stuffing, or prior compromise. No EPSS score or CISA KEV status provided in available data, but the combination of public PoC, network exposure, and IoT device context elevates practical risk. Tenda routers are commonly deployed in SOHO environments with weak credential hygiene and infrequent patching. The CVSS 4.0 Exploit Maturity (E:P) confirms proof-of-concept exists. SSVC assessment: exploitation is POC-proven, attack is automatable given network access and credentials, technical impact is total system compromise (VC:H/VI:H/VA:H). This represents a genuine priority for environments with exposed Tenda F451 devices, particularly where default credentials persist or authentication mechanisms are weak. The stack overflow enables arbitrary code execution as the router's web server process, typically running with elevated privileges on embedded systems.

An attacker conducts reconnaissance identifying a Tenda F451 router exposed on the internet via Shodan or similar scanning. Using default credentials (admin/admin) or credentials obtained from previous breaches, the attacker authenticates to the web management interface. The attacker crafts a malicious HTTP POST request to /goform/qossetting with an oversized 'qos' parameter payload containing shellcode designed to overflow the stack buffer in the fromqossetting function. Successful exploitation overwrites the return address, redirecting execution to attacker-controlled shellcode that establishes a reverse shell, installs persistent backdoor firmware, or pivots into the internal network to compromise connected devices.