F451 CVE-2026-6135

Tenda F451 firmware version 1.0.0.7_cn_svn7958. Attacker requires authenticated access to the web interface. Exploit targets the /goform/SetIpBind endpoint by manipulating the 'page' parameter to trigger stack-based buffer overflow. Remote exploitation possible.

Real-world risk is elevated due to convergence of multiple attack facilitators. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity requiring only low-privilege authentication - commonly achievable through default credentials widely documented for Tenda devices or credential stuffing attacks. The E:P (Proof-of-Concept) modifier confirms publicly available exploit code exists on GitHub, transforming this from theoretical to immediately weaponizable. However, the PR:L requirement (authenticated access needed) provides modest friction compared to unauthenticated remote code execution. No CISA KEV listing indicates this is not confirmed as actively exploited in widespread campaigns at time of analysis, though the public POC availability means adoption by opportunistic attackers targeting exposed router management interfaces is probable. EPSS data not provided, but typical characteristics (IoT device, public exploit, high CVSS) would normally correlate with moderate-to-high exploitation probability. The complete CIA triad impact (C:H/I:H/A:H) means successful exploitation grants full device compromise, enabling pivoting into internal networks, traffic interception, or botnet recruitment. Priority assessment: High for organizations with Tenda F451 devices exposed to untrusted networks; Medium-High for properly segmented management interfaces; attack automation is feasible given low complexity.

An external attacker performs network reconnaissance identifying a Tenda F451 router with web management accessible on the internet, leveraging search engines like Shodan or direct scanning. Using credential guessing against common Tenda defaults (admin/admin) or previously compromised credentials, the attacker authenticates to the administrative interface. They craft a malicious HTTP request to /goform/SetIpBind containing an oversized 'page' parameter payload (buffer exceeding stack allocation), triggering the stack overflow in fromSetIpBind function. The carefully constructed payload overwrites the return address with attacker-controlled values, redirecting execution to injected shellcode that establishes a reverse shell with root privileges, granting complete router compromise for network pivoting or malicious traffic manipulation.