Executive Summary

CVE-2026-2911 is a critical buffer overflow vulnerability found in the Tenda FH451 router firmware versions up to 1.0.0.9. The flaw exists in an unknown function handling requests to the endpoint /goform/GstDhcpSetSer.

The vulnerability arises because the product copies an input buffer to an output buffer without verifying that the input size is smaller than the output buffer size, leading to a classic buffer overflow condition.

This buffer overflow can be triggered remotely, allowing an attacker to exploit the vulnerability without local access.

Useful 0 Not Useful 0

Impact Analysis

The buffer overflow vulnerability can impact the confidentiality, integrity, and availability of the affected Tenda FH451 router.

Exploitation of this vulnerability can lead to denial of service by paralyzing the server, making the device unavailable.

Since the exploit is publicly available and easy to execute remotely, attackers can cause significant disruption without needing local access.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability exists in the Tenda FH451 router firmware versions up to 1.0.0.9, specifically in the /goform/GstDhcpSetSer endpoint which is vulnerable to buffer overflow via remote requests.

Detection would involve monitoring or testing for requests to the /goform/GstDhcpSetSer endpoint that could trigger the buffer overflow condition.

However, no specific detection commands or signatures are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

No known mitigations or countermeasures have been identified for this vulnerability.

The suggested immediate step is to replace the affected Tenda FH451 router with an alternative device that is not vulnerable.

Useful 0 Not Useful 0