The vulnerability CVE-2026-11557 exists in the Tenda F451 router's Web Management Interface component, within the fromNatlimit function in the /goform/Natlimit file. Improper handling of the 'page' argument leads to a stack-based buffer overflow, which can be triggered remotely without authentication or user interaction. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. The vulnerability affects firmware versions 1.0.0.7 and 1.0.0.9. Public exploit code is available, but no vendor patch or official remediation has been disclosed.

Successful exploitation of this vulnerability can result in stack-based buffer overflow, enabling an attacker to execute arbitrary code remotely on the affected device. This can compromise the confidentiality, integrity, and availability of the router and potentially the network it serves. The vulnerability does not require authentication or user interaction, increasing its risk. However, there is no confirmed evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the router's Web Management Interface from untrusted networks and monitor for unusual activity. Avoid exposing the management interface to the internet. Follow vendor channels for updates on patches or official mitigations.