CVE-2026-6632
Buffer Overflow in Tenda F451 httpd Enables Remote Exploit
Publication date: 2026-04-20
Last updated on: 2026-04-20
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f451 | 1.0.0.7_cn_svn7958 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda F451 router firmware version 1.0.0.7_cn_svn7958, specifically in the function fromSafeClientFilter within the /goform/SafeClientFilter component of the httpd service. It is caused by improper handling of the argument 'menufacturer/Go', which leads to a buffer overflow condition. This flaw can be exploited remotely, and an exploit is publicly available.
How can this vulnerability impact me? :
The buffer overflow vulnerability can allow an attacker to remotely execute arbitrary code on the affected device. This can lead to a complete compromise of the router, including unauthorized access, disruption of network services, and potential further attacks on connected devices. Given the high severity scores (CVSS v3.1 score of 8.8 and v2.0 score of 9.0), the impact is significant.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests sent to the endpoint "/goform/SafeClientFilter" with the parameter "menufacturer" set to "tenda" and an unusually large payload in the "Go" parameter.
A practical detection method is to capture and analyze network traffic for such suspicious POST requests that may indicate an attempt to exploit the buffer overflow.
For example, using command-line tools like curl or netcat, you can simulate or detect such requests.
- Use tcpdump or Wireshark to filter HTTP POST requests to "/goform/SafeClientFilter": tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/SafeClientFilter'
- Use curl to test the endpoint with a crafted payload: curl -X POST http://<target-ip>/goform/SafeClientFilter -d 'menufacturer=tenda&Go=$(python3 -c "print('a'*2048)")'
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint "/goform/SafeClientFilter" to trusted networks or IP addresses to prevent remote exploitation.
Additionally, monitoring and blocking suspicious HTTP POST requests with the "menufacturer" parameter set to "tenda" and large payloads can help reduce risk.
If possible, update the device firmware to a version where this vulnerability is patched or contact the vendor for a security update.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-6632 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.