CVE-2026-6196
Remote Stack-Based Buffer Overflow in Tenda F456 exeCommand
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456 | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6196 is a stack-based buffer overflow vulnerability found in the Tenda F456 router version 1.0.0.5. It occurs in the HTTP daemon's function formexeCommand, which processes a user-supplied parameter called "cmdinput."
The vulnerability arises because the user input is copied into a buffer using the unsafe strcpy function without checking the input length. This allows an attacker to overflow the stack buffer by sending an excessively long "cmdinput" value.
Exploitation is possible remotely by sending a crafted HTTP POST request to the /goform/exeCommand endpoint with a large payload in the "cmdinput" parameter. This can lead to denial of service or remote code execution on the device.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-6196 vulnerability in the Tenda F456 router version 1.0.0.5, immediate steps include restricting remote access to the device's HTTP service, especially the /goform/exeCommand endpoint, to prevent exploitation.
Additionally, monitoring network traffic for suspicious POST requests with unusually long 'cmdinput' parameters can help detect exploitation attempts.
If possible, apply any available firmware updates or patches from the vendor that address this buffer overflow vulnerability.
As a temporary measure, consider disabling remote management features or placing the device behind a firewall to limit exposure.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including denial of service (DoS) and remote code execution (RCE) on the affected Tenda F456 router.
- Denial of Service: An attacker can crash or disrupt the router's operation by exploiting the buffer overflow.
- Remote Code Execution: An attacker may execute arbitrary code remotely, potentially taking full control of the device.
- Compromise of network security and privacy due to unauthorized access or control over the router.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Tenda F456 allows remote attackers to execute arbitrary code or cause denial of service via a stack-based buffer overflow. Such unauthorized access or disruption could lead to compromise of sensitive data or system availability.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, exploitation of this vulnerability could potentially result in breaches of confidentiality, integrity, and availability of data, which are core concerns of these regulations.
Therefore, if the affected device processes or stores personal or protected health information, this vulnerability could negatively impact compliance with regulations requiring protection of such data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /goform/exeCommand with an excessively long "cmdinput" parameter. The request should include typical HTTP headers and a large payload of repeated characters in the cmdinput field to trigger the stack-based buffer overflow.
A detection command example using curl might be:
- curl -X POST http://<target-ip>/goform/exeCommand -d "cmdinput=$(python3 -c 'print("a"*1000)')" -H "Content-Type: application/x-www-form-urlencoded"
If the device is vulnerable, this request may cause a denial of service or unexpected behavior, indicating the presence of the vulnerability.