Which versions of Tenda are affected by EUVD-2026-35179?

Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) contain a remote command injection vulnerability exploitable with low-privilege web management credentials, enabling complete compromise of network…

Is there a public PoC exploit available for EUVD-2026-35179?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35179. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-35179?

Within 24 hours: Audit all Tenda F451 devices in production; immediately restrict web management interface access to trusted administrative networks only and disable remote access if possible. Within 7 days: Contact Tenda support to confirm patch availability and end-of-life status; initiate procurement of replacement equipment from vendors with demonstrated active security support. Within 30 days: Complete hardware replacement; decommission all affected F451 devices from production.

Tenda EUVD-2026-35179

Q: What is the CVSS score of EUVD-2026-35179?

EUVD-2026-35179 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-11556 HIGH

OS Command Injection (CWE-78)

2026-06-08 VulDB

GHSA-47fv-fgr6-m346

Tenda Command Injection

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:32 vuln.today

CVSS changed

Jun 08, 2026 - 18:22 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Tenda F451 routers (firmware 1.0.0.7 and 1.0.0.9) allows remote attackers with low-privileged web management access to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the /goform/WriteFacMac endpoint handled by the formWriteFacMac function. Publicly available exploit code exists, raising the practical risk for any device exposing the web management interface to untrusted networks. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit all Tenda F451 devices in production; immediately restrict web management interface access to trusted administrative networks only and disable remote access if possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-38065 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the

CVE-2026-38060 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin p

CVE-2026-38061 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volum

CVE-2026-38062 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the rat

CVE-2026-38063 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via

EUVD-2026-35179 vulnerability details – vuln.today

Back

Tenda EUVD-2026-35179

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code