Which versions of Tenda are affected by CVE-2026-6630?

Tenda F451 routers running version 1.0.0.7_cn_svn7958 are vulnerable to authenticated remote code execution through a buffer overflow in the DHCP configuration endpoint.

Is there a public PoC exploit available for CVE-2026-6630?

Yes, a public proof-of-concept exploit is available for CVE-2026-6630. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6630?

Within 24 hours: Inventory all Tenda F451 routers in production and verify current firmware versions. Within 7 days: Restrict management interface access to trusted administrative networks only via firewall rules; disable remote management if not operationally required. Within 30 days: Contact Tenda for patched firmware availability; if no patch is released, evaluate replacement with a vendor offering active security support and begin migration planning.

Tenda CVE-2026-6630

Q: What is the CVSS score of CVE-2026-6630?

CVE-2026-6630 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23827 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-20 VulDB

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 22, 2026 - 20:22 vuln.today

Public exploit code

Analysis Updated

Apr 20, 2026 - 11:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Apr 20, 2026 - 11:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 20, 2026 - 11:05 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 10:45 euvd

EUVD-2026-23827

Analysis Generated

Apr 20, 2026 - 10:45 vuln.today

CVE Published

Apr 20, 2026 - 10:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. Performing a manipulation of the argument dips results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Remote buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated attackers to achieve arbitrary code execution via crafted DHCP server configuration requests. The vulnerability exists in the httpd service's /goform/GstDhcpSetSer endpoint, exploitable by manipulating the 'dips' parameter. Public exploit code is available on GitHub, significantly lowering exploitation barriers for authenticated attackers with network access to the router's management interface.

Technical ContextAI

This vulnerability affects the httpd web server component in Tenda F451 wireless routers, specifically within the fromGstDhcpSetSer function responsible for handling DHCP server configuration via the /goform/GstDhcpSetSer endpoint. The root cause is a classic stack-based buffer overflow (CWE-120) where insufficient bounds checking on the 'dips' parameter allows attacker-controlled input to exceed allocated buffer space. When processing DHCP server settings through the web management interface, the function copies user-supplied data without proper length validation, enabling memory corruption. This class of vulnerability is common in embedded device firmware where legacy C code lacks modern memory safety protections. The affected product is identified by CPE cpe:2.3:a:tenda:f451:*:*:*:*:*:*:*:*, indicating the Tenda F451 router line, with confirmed vulnerable firmware version 1.0.0.7_cn_svn7958.

RemediationAI

Check the Tenda official website (https://www.tenda.com.cn/) for firmware updates addressing this buffer overflow vulnerability. At time of analysis, no vendor-released patched firmware version was identified in available data. If no patch is available, implement these compensating controls with noted trade-offs: (1) Disable remote management access to the router's web interface from WAN side - limits attack surface to LAN-based threats only but prevents legitimate remote administration; (2) Change default administrative credentials to strong unique passwords (16+ characters, mixed case, numbers, symbols) - significantly raises exploitation bar since PR:L authentication is required, though doesn't eliminate risk from credential theft; (3) Implement network segmentation to isolate the router management interface from untrusted LAN clients - reduces attack surface but adds configuration complexity; (4) Monitor router logs for unusual DHCP configuration change attempts or failed authentication patterns - provides detection capability but no prevention. For high-security environments, consider replacing affected Tenda F451 devices with alternative router models from vendors with established security patch programs, as no patch timeline was provided by Tenda for this vulnerability.