F451 CVE-2026-6136

Requires authenticated access to Tenda F451 router running firmware version 1.0.0.7_cn_svn7958. Attacker must send crafted POST request with malicious 'page' parameter to /goform/L7Im endpoint. No victim interaction needed.

Real-world risk is HIGH despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects severity: network attack vector (AV:N) means internet-exposed routers are vulnerable, low attack complexity (AC:L) indicates exploitation is straightforward, and the complete CIA triad impact (C:H/I:H/A:H) enables full device compromise. Critically, publicly available exploit code exists (GitHub POC at referenced issue), which dramatically reduces the skill threshold for exploitation. While low-privilege authentication is required, consumer routers frequently use default credentials (admin/admin), and credential stuffing attacks are trivial against these devices. The vulnerability is NOT confirmed actively exploited per CISA KEV, but the POC publication combined with widespread Tenda router deployment in SOHO environments creates significant exposure. EPSS probability data not provided, but stack overflows in router firmware with public POCs historically see rapid weaponization. SSVC factors: exploitation status is POC-public (elevating urgency), automatable (yes-web request injection), technical impact is total system compromise. The primary risk mitigation is that many F451 devices may be behind NAT without exposed admin interfaces, but UPnP misconfigurations and credential reuse remain common attack surfaces.

An attacker identifies a Tenda F451 router exposed on the internet via Shodan or mass-scanning of default router ports. Using credential stuffing with common default passwords (admin/admin), the attacker authenticates to the web management interface at /goform/L7Im. They craft a malicious HTTP POST request containing an oversized 'page' parameter payload designed to overflow the stack buffer in frmL7ImForm, embedding shellcode that spawns a reverse shell. The overflow overwrites the function's return address, redirecting execution to attacker-controlled code running with root privileges. The attacker now has full router control, enabling DNS hijacking to redirect victim traffic, installation of persistent backdoors, lateral movement into the connected LAN, or conscription into a botnet. The publicly available POC at GitHub provides ready-made exploit scaffolding requiring minimal adaptation.