F451 EUVD-2026-21722

Requires authenticated access to Tenda F451 router running firmware 1.0.0.7. Attacker must have low-privilege user credentials to access the /goform/L7Prot endpoint in the httpd service and send a crafted request with oversized 'page' parameter.

Real-world risk is HIGH despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects the severe impact potential: network-accessible attack vector (AV:N), low complexity (AC:L), and full confidentiality/integrity/availability compromise (C:H/I:H/A:H). The CVSS temporal metric shows proof-of-concept code exists (E:P), which is confirmed by the publicly available GitHub exploit. No KEV listing indicates no confirmed active exploitation in enterprise environments at analysis time, but consumer IoT devices are often exploited without formal KEV documentation. SSVC assessment: exploitation status is POC-available (not actively exploited per KEV data), automatable is likely YES given low complexity and remote vector, technical impact is TOTAL system compromise. Primary risk factors elevating this above theoretical concerns: (1) public exploit lowers attacker skill requirements, (2) home routers often have weak/default credentials making PR:L trivial to satisfy, (3) IoT devices rarely receive security updates, creating persistent exposure windows. This is a realistic remote code execution risk for Tenda F451 deployments, particularly in SOHO environments with poor credential hygiene.

An attacker identifies a Tenda F451 router (version 1.0.0.7) on a home network using port scanning and banner grabbing. Using common default credentials or previously compromised low-privilege accounts (satisfying PR:L), the attacker authenticates to the web management interface and sends a specially crafted HTTP POST request to /goform/L7Prot with an oversized 'page' parameter (leveraging publicly available GitHub POC). The malicious input triggers the stack buffer overflow in frmL7ProtForm, overwriting the return address to redirect execution to attacker-supplied shellcode embedded in the payload. The router executes the code with root privileges, establishing a reverse shell to the attacker's command server. With full device control, the attacker reconfigures DNS settings for man-in-the-middle attacks, installs persistent backdoors, or pivots to attack devices on the internal network.