Which versions of Tenda are affected by CVE-2026-6136?

Tenda F451 wireless routers (firmware 1.0.0.7_cn_svn7958) contain a critical stack-based buffer overflow vulnerability allowing authenticated attackers to gain complete control of affected devices.

Is there a public PoC exploit available for CVE-2026-6136?

Yes, a public proof-of-concept exploit is available for CVE-2026-6136. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6136?

Within 24 hours: Identify all Tenda F451 devices in production using network scanning and disable remote management access to the /goform/L7Im endpoint via firewall rules. Within 7 days: Contact Tenda for patch status and establish a vendor communication tracking log; isolate affected routers to segregated network segments if patch is unavailable. Within 30 days: Evaluate router replacement options with vendors offering active security support; migrate to alternative wireless infrastructure if Tenda confirms no patch availability.

Tenda CVE-2026-6136

Q: What is the CVSS score of CVE-2026-6136?

CVE-2026-6136 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21756 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

GHSA-2972-7g9m-9qv2

Tenda Stack Overflow Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 12:36 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 00:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 23:57 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 23:45 euvd

EUVD-2026-21756

Analysis Generated

Apr 12, 2026 - 23:45 vuln.today

CVE Published

Apr 12, 2026 - 23:30 nvd

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 wireless router (firmware 1.0.0.7_cn_svn7958) allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in the frmL7ImForm function handling the 'page' parameter at /goform/L7Im endpoint. Publicly available exploit code exists (GitHub POC published), significantly lowering exploitation barriers. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity, requiring only low-privilege authentication. No vendor-released patch identified at time of analysis.

Technical ContextAI

This vulnerability affects the Tenda F451 wireless router's web management interface, specifically within the Layer 7 application identification module (L7Im). The stack-based buffer overflow (CWE-121) occurs when the frmL7ImForm function processes user-supplied input to the 'page' parameter without proper bounds checking before copying data to a fixed-size stack buffer. Stack-based overflows are particularly dangerous in embedded devices like routers because they can overwrite return addresses and function pointers, enabling control-flow hijacking. The affected endpoint /goform/L7Im is part of the router's CGI-based web administration interface, which typically runs with elevated system privileges. The CPE identifier cpe:2.3:a:tenda:f451 confirms this affects Tenda's F451 product line, a consumer-grade wireless router common in Chinese markets. Unlike heap-based overflows, stack-based variants are often more reliable for exploitation due to deterministic memory layouts in embedded firmware.

RemediationAI

No vendor-released patch identified at time of analysis. Users should immediately implement the following mitigations: First, disable remote administration access to the router's web interface and restrict management access to trusted local network segments only (typically via router's Security or Remote Management settings). Second, change default administrative credentials to strong, unique passwords (minimum 16 characters, alphanumeric with symbols). Third, place the router behind a properly configured firewall that blocks inbound connections to management ports (typically TCP 80/443/8080). Fourth, monitor Tenda's security advisory page at https://www.tenda.com.cn/ and the product support portal for firmware updates addressing CVE-2026-6136. Fifth, consider replacing the device with alternative hardware if Tenda does not release a patch within a reasonable timeframe, as end-of-life consumer routers rarely receive security updates. Organizations should audit network perimeters for exposed F451 devices using Shodan or internal scanning tools. The VulDB entry at https://vuldb.com/vuln/357000 and exploit details at https://github.com/Jimi-Lab/cve/issues/21 provide technical indicators for detection rules.