F451 Firmware CVE-2026-6137

Requires authenticated access to Tenda F451 router (firmware 1.0.0.7_cn_svn7958). Attacker must send crafted POST request to /goform/AdvSetWan endpoint with malicious wanmode or PPPOEPassword parameters to trigger stack-based buffer overflow. Non-default administrative credentials needed.

Real-world exploitation risk is elevated due to convergence of multiple threat signals. The CVSS 4.0 vector (AV:N/AC:L/PR:L/E:P) indicates network-accessible attack surface with low complexity requiring only low-privilege authentication-router management credentials frequently left at defaults or easily compromised. The E:P (Proof-of-concept) modifier confirms publicly available exploit code exists per the GitHub reference, dramatically reducing attacker effort from theoretical to operational. Attack vector is network-based (AV:N), meaning exposure extends to any network from which the management interface is reachable, including Internet-facing deployments with remote administration enabled. However, authentication requirement (PR:L) provides partial mitigation-attackers need valid credentials first, likely obtained via credential stuffing, default passwords, or prior compromise. No CISA KEV listing indicates no confirmed mass exploitation campaigns at time of analysis, but SOHO routers are high-value targets for botnet recruitment and network pivoting. CVSS High score (7.4) accurately reflects the technical severity given complete CIA triad impact post-authentication. Organizations should prioritize remediation for Internet-exposed instances and deployments with weak credential hygiene.

An attacker on the same network as the Tenda F451 router (or with Internet access if remote administration is enabled) first obtains valid administrative credentials through password guessing, default credential use, or phishing. The attacker then authenticates to the web interface and navigates to the Advanced WAN Settings page. By crafting a malicious HTTP POST request to /goform/AdvSetWan with oversized wanmode or PPPOEPassword parameter values exceeding stack buffer capacity, the attacker triggers memory corruption that overwrites the function return address. This redirects execution flow to attacker-controlled shellcode embedded in the request payload, achieving arbitrary code execution as root on the router's embedded Linux OS.