CVE-2026-2911
Remote Buffer Overflow in Tenda FH451 /goform/GstDhcpSetSer
Publication date: 2026-02-22
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | fh451_firmware | 1.0.0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2911 is a critical buffer overflow vulnerability found in the Tenda FH451 router firmware versions up to 1.0.0.9. The flaw exists in an unknown function handling requests to the endpoint /goform/GstDhcpSetSer.
The vulnerability arises because the product copies an input buffer to an output buffer without verifying that the input size is smaller than the output buffer size, leading to a classic buffer overflow condition.
This buffer overflow can be triggered remotely, allowing an attacker to exploit the vulnerability without local access.
How can this vulnerability impact me? :
The buffer overflow vulnerability can impact the confidentiality, integrity, and availability of the affected Tenda FH451 router.
Exploitation of this vulnerability can lead to denial of service by paralyzing the server, making the device unavailable.
Since the exploit is publicly available and easy to execute remotely, attackers can cause significant disruption without needing local access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability exists in the Tenda FH451 router firmware versions up to 1.0.0.9, specifically in the /goform/GstDhcpSetSer endpoint which is vulnerable to buffer overflow via remote requests.
Detection would involve monitoring or testing for requests to the /goform/GstDhcpSetSer endpoint that could trigger the buffer overflow condition.
However, no specific detection commands or signatures are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
No known mitigations or countermeasures have been identified for this vulnerability.
The suggested immediate step is to replace the affected Tenda FH451 router with an alternative device that is not vulnerable.