Which versions of Tenda are affected by CVE-2026-6631?

CVE-2026-6631 is a buffer overflow vulnerability in Tenda F451 router firmware (version 1.0.0.7_cn_svn7958) that allows authenticated attackers to execute arbitrary code, compromising…

Is there a public PoC exploit available for CVE-2026-6631?

Yes, a public proof-of-concept exploit is available for CVE-2026-6631. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6631?

Within 24 hours: Identify all Tenda F451 devices running firmware 1.0.0.7_cn_svn7958 in your network using asset management or network scanning tools. Within 7 days: Isolate affected devices on a segregated network segment with strict access controls; document business justification for any devices that cannot be immediately replaced. Within 30 days: Replace Tenda F451 router(s) with supported alternatives from active-lifecycle vendors; if replacement is not feasible, implement network-level controls (WAF, IPS signatures) to block malicious 'page' parameter submissions to /goform/webExcptypemanFilter.

Tenda CVE-2026-6631

Q: What is the CVSS score of CVE-2026-6631?

CVE-2026-6631 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23828 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-20 VulDB

GHSA-2836-hmqw-wf98

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

PoC Detected

Apr 22, 2026 - 20:22 vuln.today

Public exploit code

Analysis Generated

Apr 20, 2026 - 11:29 vuln.today

CVSS changed

Apr 20, 2026 - 11:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 11:15 euvd

EUVD-2026-23828

Analysis Generated

Apr 20, 2026 - 11:15 vuln.today

CVE Published

Apr 20, 2026 - 10:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Buffer overflow in Tenda F451 router (version 1.0.0.7_cn_svn7958) allows authenticated remote attackers to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability exists in the httpd component's webExcptypemanFilter function, exploitable via malicious 'page' parameter input to /goform/webExcptypemanFilter. Public exploit code is available on GitHub (CVSS 7.4, CWE-120). EPSS data not provided, not listed in CISA KEV. This targets a specific legacy Chinese firmware version of a consumer-grade router with known end-of-life support issues.

Technical ContextAI

This is a classic stack-based or heap-based buffer overflow (CWE-120) in the httpd web server daemon of Tenda F451 wireless routers. The vulnerable function fromwebExcptypemanFilter processes HTTP POST requests to the /goform/webExcptypemanFilter endpoint without proper bounds checking on the 'page' parameter. When an attacker supplies an oversized or specially crafted 'page' value, it overflows the allocated buffer, potentially overwriting return addresses or function pointers in memory. The affected product (cpe:2.3:a:tenda:f451:*:*:*:*:*:*:*:*) is a budget consumer WiFi router running embedded Linux with a proprietary web management interface. The specific vulnerable build is 1.0.0.7_cn_svn7958, a Chinese market firmware release. Tenda routers have a documented history of memory safety vulnerabilities due to insufficient input validation in CGI-style web handlers. The httpd component runs with elevated privileges (typically root) on these embedded devices, making successful exploitation particularly severe.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a security advisory or updated firmware for CVE-2026-6631 according to available references. Users of Tenda F451 version 1.0.0.7_cn_svn7958 should check the official Tenda support site (https://www.tenda.com.cn/) for firmware updates, though this legacy Chinese-market build may no longer receive security support. Compensating controls with specific trade-offs: (1) Disable remote web administration access entirely via router settings and manage the device only from trusted LAN segments - eliminates network attack vector but requires physical/local access for configuration changes. (2) Change default admin credentials to strong unique passwords (20+ characters, random) - raises the authentication bar but does not eliminate risk if credentials are compromised. (3) Place Tenda F451 devices behind a firewall that restricts management interface access to specific admin workstation IPs via ACLs - reduces exposure but adds network complexity and breaks remote management workflows. (4) Replace affected hardware with currently-supported router models from vendors with active security programs - most effective long-term solution but requires capital expenditure and network downtime. For enterprise environments, replacement is strongly recommended given Tenda's consumer focus and inconsistent security patching history.