F451 CVE-2026-6632

Requires authenticated access to the Tenda F451 router's web administration interface, typically accessible on LAN (192.168.0.1 or similar) via HTTP/HTTPS on TCP ports 80/443. Attacker must possess valid admin credentials - either default credentials (if unchanged), credentials obtained via phishing/social engineering, or credentials leaked from previous compromise. The /goform/SafeClientFilter endpoint must be reachable, which is standard in default configurations for client filtering management features. Exploitation is possible from any network zone where the router's admin interface is accessible - LAN clients, guest WiFi users if admin interface not isolated, or WAN if remote management enabled (non-default). The CVSS vector PR:L (low privileges required) confirms authentication is mandatory but does not require elevated admin roles beyond standard router login. No specific non-default feature enablement or advanced configuration required - vulnerability exists in core httpd request handling.

Real-world risk is MODERATE despite high CVSS score. CVSS 7.4 (AV:N/AC:L/PR:L) indicates network-based exploitation with low complexity, but requires authenticated access to the router's admin interface - typically restricted to LAN users or those with compromised credentials. The CVSS E:P (Proof-of-concept exploit) modifier confirms public PoC availability via GitHub, lowering attacker barrier to entry. However, absence from CISA KEV suggests no mass exploitation campaigns. EPSS score unavailable but likely moderate given the device type (consumer routers are frequent targets) and public PoC. Primary risk scenario: attacker with existing LAN access (e.g., guest WiFi user, rogue employee, or phished admin credentials) escalates to full router control, enabling man-in-the-middle attacks, DNS hijacking, or botnet enrollment. SSVC decision factors tilt toward deferral for most enterprises - low technical impact outside environments where these specific Tenda routers are deployed, but CRITICAL for organizations actually using affected models in production networks.

Attacker connects to corporate guest WiFi network served by vulnerable Tenda F451 router. Using default or previously leaked admin credentials, attacker authenticates to web interface at http://192.168.0.1. Attacker submits crafted HTTP POST request to /goform/SafeClientFilter endpoint with oversized 'menufacturer' parameter (e.g., 512-byte payload containing shellcode and ROP chain). Buffer overflow overwrites return address, redirecting execution to attacker-controlled code running with httpd process privileges. Attacker establishes persistent backdoor, intercepts all LAN traffic, and pivots to internal network resources.