F451 CVE-2026-6631

Requires valid authentication credentials to the Tenda F451 web management interface (CVSS:4.0 PR:L indicates low-privileged authentication required). Exploitation targets the /goform/webExcptypemanFilter endpoint, which is part of the standard web administration interface accessible when remote management is enabled (typically enabled by default on consumer routers). The vulnerable function fromwebExcptypemanFilter is triggered by HTTP POST requests with a manipulated 'page' parameter. No specialized network position is required beyond network accessibility to the router's management interface (AV:N, AC:L). Limiting factors: (1) Authentication barrier - attacker needs admin username/password, either through default credentials, credential reuse, or prior compromise. (2) Specific firmware version - only version 1.0.0.7_cn_svn7958 is confirmed vulnerable; other F451 builds may or may not be affected. (3) No user interaction required (UI:N) once credentials are obtained. If the router's web interface is exposed to the internet or attacker-controlled networks, and uses weak/default credentials, exploitation is straightforward with public POC code.

Real-world risk is MODERATE despite the 7.4 CVSS score. The CVSS:4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity, BUT requires authentication (PR:L), significantly reducing the attack surface compared to unauthenticated RCE. The E:P metric confirms proof-of-concept exploit code exists publicly on GitHub. However, multiple factors limit widespread risk: (1) Targets a single legacy firmware version (1.0.0.7_cn_svn7958) from the Chinese market, not current global releases. (2) Requires valid router admin credentials - attackers need prior compromise via credential stuffing, default passwords, or social engineering. (3) No CISA KEV listing suggests this is not being exploited at scale in real-world incidents. (4) Tenda F451 is an aging consumer product with limited enterprise deployment. SSVC assessment: Exploitation=POC, Automatable=No (needs auth), Technical Impact=Total (code execution). This is a real vulnerability warranting patching for affected users, but not a critical infrastructure emergency. Primary risk scenario is targeted attacks against known Tenda deployments using default/weak credentials, or as a pivot point after initial network compromise.

An attacker on the internet identifies a Tenda F451 router (version 1.0.0.7_cn_svn7958) with web management exposed on port 80/443, possibly via Shodan or Censys scanning. Using default credentials (admin/admin) or credentials obtained from a previous breach, the attacker authenticates to the web interface. They then reference the public GitHub exploit code (https://github.com/Jimi-Lab/cve/issues/25) to craft a malicious HTTP POST request to /goform/webExcptypemanFilter with an oversized 'page' parameter containing shellcode. The buffer overflow corrupts memory in the httpd process, redirecting execution to attacker-controlled code running as root. The attacker achieves full router compromise, installing persistent backdoors, harvesting LAN traffic, pivoting to internal network systems, or conscripting the device into a botnet.