CVE-2026-4535
Remote Stack-Based Buffer Overflow in Tenda FH451 WrlclientSet
Publication date: 2026-03-22
Last updated on: 2026-04-03
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | fh451_firmware | 1.0.0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-4535 is a critical vulnerability in the Tenda FH451 router, version 1.0.0.9. It is a stack-based buffer overflow found in the HTTP daemon\'s WrlclientSet function. This function processes a user-supplied parameter named "GO" without validating its length. When an attacker sends a specially crafted HTTP POST request with an excessively long "GO" parameter to the /goform/WrlclientSet endpoint, it causes the buffer to overflow.'}, {'type': 'paragraph', 'content': 'This overflow occurs because the input is copied into a fixed-size stack buffer using the sprintf function without proper length checks, leading to memory corruption.'}, {'type': 'paragraph', 'content': 'Exploitation of this vulnerability can lead to denial of service (DoS) or remote code execution (RCE) on the affected device.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts on users of the Tenda FH451 router version 1.0.0.9. An attacker can remotely exploit the buffer overflow by sending a crafted HTTP POST request, which may result in:
- Denial of Service (DoS) - causing the router to crash or become unresponsive.
- Remote Code Execution (RCE) - allowing the attacker to execute arbitrary code on the device, potentially taking full control over it.
Such control could lead to interception of network traffic, unauthorized access to the internal network, or further attacks on connected devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for specially crafted HTTP POST requests sent to the endpoint /goform/WrlclientSet containing an excessively long "GO" parameter.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze HTTP traffic to identify POST requests targeting /goform/WrlclientSet with unusually large payloads in the "GO" parameter.'}, {'type': 'paragraph', 'content': 'For example, using command-line tools like curl or wget to send test requests or using network monitoring tools such as tcpdump or Wireshark to filter and inspect HTTP POST requests can help detect attempts to exploit this vulnerability.'}, {'type': 'list_item', 'content': "Use tcpdump to capture HTTP POST requests to /goform/WrlclientSet: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/WrlclientSet'"}, {'type': 'list_item', 'content': 'Use curl to test the endpoint with a large GO parameter: curl -X POST http://<target-ip>/goform/WrlclientSet -d \'GO=$(python3 -c "print(\'A\'*1000)")\''}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the vulnerable endpoint /goform/WrlclientSet by implementing firewall rules or access control lists to block unauthorized or suspicious HTTP POST requests.'}, {'type': 'paragraph', 'content': 'Additionally, monitoring and filtering HTTP traffic to detect and block requests with abnormally large "GO" parameters can reduce the risk of exploitation.'}, {'type': 'paragraph', 'content': 'If possible, update the firmware of the Tenda FH451 router to a version that patches this vulnerability or apply any vendor-provided security updates.'}, {'type': 'paragraph', 'content': 'Until a patch is available, consider isolating the device from untrusted networks or limiting remote management access.'}] [1]