F451 CVE-2026-6630

Low-privileged authentication (PR:L) to the Tenda F451 router's web management interface is required - this is the critical gating factor. Attacker must have valid credentials (admin or user account) to access the /goform/GstDhcpSetSer endpoint before the buffer overflow can be triggered. The vulnerability affects the DHCP server configuration functionality specifically, so this feature must be accessible to authenticated users (typically enabled by default in router firmware). Network access (AV:N) to the router's management interface is required, either from LAN side (common) or WAN side if remote management is enabled (less common but higher risk). Attack complexity is low (AC:L) with no additional timing requirements (AT:N) and no user interaction needed (UI:N) beyond the attacker's own authenticated session. Exploitation is NOT possible against default configurations without credential compromise - the PR:L requirement fundamentally limits this from being a wormable or mass-exploitation vulnerability. The vulnerability is specific to firmware version 1.0.0.7_cn_svn7958, though other versions may be affected pending additional vendor disclosure.

Real-world risk is MODERATE despite the high CVSS 7.4 score. The CVSS v4.0 vector confirms network-based attack (AV:N) with low complexity (AC:L) but requires low-privileged authentication (PR:L), meaning attackers need valid router admin or user credentials before exploitation. The publicly available exploit code (E:P in CVSS, GitHub POC confirmed) reduces technical barriers for authenticated attackers. However, the PR:L requirement is a significant limiting factor - this is NOT an unauthenticated remote code execution. The attack is not automatable at scale because credential acquisition is a prerequisite. High impact ratings (VC:H/VI:H/VA:H) indicate full system compromise is possible post-authentication, with potential for persistent backdoor installation on the router. No EPSS score or KEV status provided in data, suggesting limited observed exploitation in enterprise environments. Primary risk is to SOHO and small business networks where default/weak router credentials are common, or in scenarios where attackers have already obtained credentials via phishing or credential stuffing. The combination of public POC plus authentication requirement places this in 'monitor and patch when feasible' category rather than emergency response, unless your environment has exposed Tenda F451 devices with known credential compromise.

An attacker who has obtained valid credentials to the Tenda F451 router's web management interface (via default passwords, credential stuffing, or prior compromise) logs into the admin panel and navigates to DHCP server settings. The attacker crafts a malicious HTTP POST request to /goform/GstDhcpSetSer with an oversized 'dips' parameter value designed to overflow the buffer in the fromGstDhcpSetSer function. This triggers memory corruption that overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode. The attacker achieves arbitrary code execution with the privileges of the httpd process (typically root on embedded devices), enabling full router compromise, persistent backdoor installation, traffic interception, or pivot attacks into the LAN. Public exploit code available at https://github.com/Jimi-Lab/cve/issues/23 provides ready-made attack tooling.