Which versions of Tenda are affected by EUVD-2026-21720?

Tenda F451 router firmware versions up to 1.0.0.7 contain a stack-based buffer overflow vulnerability (CVSS 8.8) in the wireless configuration service that allows authenticated attackers to gain…

Is there a public PoC exploit available for EUVD-2026-21720?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21720. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-21720?

Within 24 hours: Inventory all Tenda F451 routers in production and document current firmware versions. Within 7 days: Restrict network access to router administration interfaces using firewall rules and disable remote management if not operationally required; implement network segmentation to isolate affected routers. Within 30 days: Contact Tenda for firmware update availability; if no patch release is announced, evaluate replacement with patched router models or implement persistent compensating controls including authenticated access restrictions and continuous network monitoring.

Tenda EUVD-2026-21720

Q: What is the CVSS score of EUVD-2026-21720?

EUVD-2026-21720 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6121 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-12 VulDB

Buffer Overflow Stack Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:07 vuln.today

cvss_changed

PoC Detected

Apr 29, 2026 - 20:02 vuln.today

Public exploit code

CVSS changed

Apr 12, 2026 - 08:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 12, 2026 - 07:35 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 07:30 euvd

EUVD-2026-21720

Analysis Generated

Apr 12, 2026 - 07:30 vuln.today

CVE Published

Apr 12, 2026 - 07:15 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda F451 1.0.0.7. Affected by this vulnerability is the function WrlclientSet of the file /goform/WrlclientSet of the component httpd. This manipulation of the argument GO causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F451 router firmware version 1.0.0.7 allows authenticated remote attackers to achieve full system compromise via crafted HTTP requests to the wireless client configuration endpoint. The vulnerability (CVSS 8.8) exists in the WrlclientSet function within the httpd service and requires only low-privilege authentication. Publicly available exploit code has been published on GitHub, significantly lowering the barrier to exploitation, though no active exploitation is confirmed in CISA KEV at time of analysis.

Technical ContextAI

This vulnerability affects the httpd web server component of Tenda F451 wireless router firmware (CPE: cpe:2.3:a:tenda:f451:*:*:*:*:*:*:*:*). The flaw is classified as CWE-121 (Stack-based Buffer Overflow) occurring in the WrlclientSet function, which handles wireless client configuration requests via the /goform/WrlclientSet endpoint. The vulnerability stems from inadequate input validation of the 'GO' parameter, allowing an attacker to overflow a stack-allocated buffer. Stack-based buffer overflows are memory corruption vulnerabilities where user-controlled data exceeds the bounds of a fixed-size buffer allocated on the program stack, potentially overwriting return addresses, function pointers, or other critical control data. In embedded router firmware with limited security mitigations, successful exploitation typically yields arbitrary code execution with the privileges of the httpd service, often running as root on IoT devices.

RemediationAI

Users of Tenda F451 routers running firmware 1.0.0.7 should immediately check for firmware updates through the Tenda support portal at https://www.tenda.com.cn/ and apply any available security patches. No vendor-released patch version is independently confirmed from the provided data sources; organizations should contact Tenda technical support directly for patch availability and deployment guidance. As immediate risk mitigation while awaiting patches: (1) disable remote administration interfaces and restrict administrative access to trusted internal networks only, (2) change default credentials to strong unique passwords, (3) implement network segmentation to isolate vulnerable routers from critical assets, (4) monitor router logs for suspicious POST requests to /goform/WrlclientSet endpoint. For organizations with strict security requirements and no available patch, consider replacing affected devices with alternative router models from vendors with established security update programs. Review VulDB entry https://vuldb.com/vuln/356984 and GitHub POC https://github.com/Jimi-Lab/cve/issues/12 for technical indicators to support detection efforts.