Which versions of Tenda are affected by CVE-2026-6135?

Tenda F451 routers running firmware 1.0.0.7_cn_svn7958 are vulnerable to authenticated remote code execution via a stack buffer overflow, allowing attackers to gain complete control of the device.

Is there a public PoC exploit available for CVE-2026-6135?

Yes, a public proof-of-concept exploit is available for CVE-2026-6135. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6135?

Within 24 hours: Identify all Tenda F451 devices running firmware version 1.0.0.7_cn_svn7958 in your environment and document inventory. Within 7 days: Restrict network access to the /goform/SetIpBind endpoint via firewall rules or network segmentation; disable remote management interfaces where not operationally critical. Within 30 days: Monitor Tenda security advisories for patched firmware release and establish upgrade testing procedure; conduct network assessment for unauthorized access attempts targeting this endpoint.

Tenda CVE-2026-6135

Q: What is the CVSS score of CVE-2026-6135?

CVE-2026-6135 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21754 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

GHSA-wf8p-3rw2-5hv3

Tenda Stack Overflow Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 12:36 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 00:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 23:41 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 23:30 euvd

EUVD-2026-21754

Analysis Generated

Apr 12, 2026 - 23:30 vuln.today

CVE Published

Apr 12, 2026 - 23:15 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromSetIpBind of the file /goform/SetIpBind. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7_cn_svn7958 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSetIpBind function accessible via /goform/SetIpBind endpoint, where manipulation of the 'page' parameter triggers memory corruption. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation despite requiring low-privilege authentication. CVSS 8.8 severity reflects network accessibility, low attack complexity, and complete system compromise potential.

Technical ContextAI

This vulnerability affects the web management interface of Tenda F451 wireless routers, specifically within the IP-MAC binding configuration functionality. The fromSetIpBind function in the /goform/SetIpBind endpoint fails to properly validate the length of the 'page' parameter before copying it to a fixed-size stack buffer. CWE-121 (stack-based buffer overflow) represents a critical memory safety flaw where unbounded data writes to automatic variables can overwrite adjacent memory regions including return addresses and saved frame pointers. In embedded router firmware like Tenda's implementation, these vulnerabilities frequently occur in CGI-style web handlers that process user-supplied parameters without adequate bounds checking. The affected CPE (cpe:2.3:a:tenda:f451) identifies this as a firmware vulnerability in the F451 router product line, where successful exploitation can lead to control-flow hijacking and arbitrary code execution in the context of the web server process, typically running with elevated system privileges on IoT devices.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda's official website (https://www.tenda.com.cn/) should be monitored for firmware updates addressing this vulnerability, though Tenda's historical patch release cadence for end-of-life or budget router models is inconsistent. Immediate compensating controls include: disable remote management access to the web interface and restrict administrative access to trusted IP addresses only via access control lists or firewall rules; change default administrative credentials to strong unique passwords to raise the authentication barrier; deploy network segmentation isolating IoT devices from critical assets; implement intrusion detection signatures monitoring for exploitation attempts targeting /goform/SetIpBind with oversized 'page' parameters. For risk-intolerant environments, device replacement with actively supported router models from vendors with established vulnerability disclosure and patching programs represents the most definitive remediation. Organizations should assess whether Tenda F451 devices meet security requirements for continued production use given the absence of confirmed patch availability and the device's position in network architecture.