Stack Overflow in Tenda FH451 Router Firmware

Executive Summary

CVE-2026-36786 is a stack-based buffer overflow vulnerability found in the Tenda FH451 router, version V1.0.0.9. It occurs in the fromDhcpListClient function, which processes HTTP requests. Specifically, the vulnerability is triggered when an attacker sends a crafted HTTP request with a long 'list1' parameter. The function uses unsafe string operations without proper bounds checking, causing a buffer overflow on the stack.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted HTTP request to the vulnerable Tenda FH451 router's fromDhcpListClient endpoint. Specifically, an HTTP request with the parameter list1 set to a long string (for example, 888 'a' characters) and LISTLEN set to 1 can trigger the stack overflow.

A detection command could involve using curl or a similar HTTP client to send this crafted request and observe if the device crashes or becomes unresponsive, indicating the presence of the vulnerability.

• curl -X GET "http://<router-ip>/fromDhcpListClient?list1=$(python -c 'print("a"*888)')&LISTLEN=1"

If the device crashes or shows instability after this request, it is likely vulnerable to CVE-2026-36786.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the fromDhcpListClient endpoint to trusted networks only, such as by using firewall rules or network segmentation.

Additionally, monitoring and blocking suspicious HTTP requests containing unusually long parameters to this endpoint can help prevent exploitation.

Ultimately, updating the router firmware to a version that patches this stack overflow vulnerability is recommended once available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) on the affected device. By sending a specially crafted HTTP request, the attacker can cause the router to crash or become unstable, disrupting network connectivity and availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-36786 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0