F451 EUVD-2026-21750

Requires authenticated access to Tenda F451 router version 1.0.0.7_cn_svn7958. Attacker must be logged into the device's web interface to access the /goform/SafeUrlFilter endpoint and manipulate the 'page' parameter to trigger the stack-based buffer overflow. No victim interaction required beyond authentication.

Real-world risk is HIGH despite requiring authentication. The CVSS 8.8 score accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). The authentication requirement (PR:L) provides limited protection since many SOHO routers use default credentials or weak passwords that remain unchanged by users. The existence of publicly available exploit code (GitHub POC) dramatically increases risk by enabling script-kiddie-level attacks. EPSS data was not provided, but similar router vulnerabilities with public exploits typically show elevated exploitation probability. No CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild, though the public POC makes exploitation accessible. From an SSVC perspective: exploitation status is POC-available (medium risk), technical impact is total (highest), and automatable is likely yes given the straightforward nature of web-based buffer overflows. The scope is unchanged (S:U), meaning exploitation is contained to the router itself, but router compromise often serves as a beachhead for broader network attacks. Primary risk factors: public exploit availability, low attack complexity, and the systemic problem of unpatched embedded devices in home/small office environments.

An attacker on the internet identifies a Tenda F451 router through Shodan or similar scanning (many expose management interfaces on WAN). Using credential stuffing with common default passwords (admin/admin) or previously breached credentials, the attacker authenticates to the router's web interface. They then send a specially crafted HTTP request to /goform/SafeUrlFilter with an oversized 'page' parameter payload designed to overflow the stack buffer in fromSafeUrlFilter. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode. With code execution at the router's privilege level, the attacker installs persistent backdoor firmware, manipulates DNS settings to redirect traffic through attacker-controlled servers for credential harvesting, or uses the compromised router as a foothold to attack devices on the internal network. The publicly available GitHub POC (https://github.com/Jimi-Lab/cve/issues/17) provides ready-made exploit code, reducing the technical skill required to script-kiddie level.