The vulnerability CVE-2026-5989 affects Tenda F451 firmware version 1.0.0.7. It involves a stack-based buffer overflow in the fromRouteStatic function of the /goform/RouteStatic endpoint. An attacker can remotely manipulate the 'page' argument to cause this overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, no confirmed active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting remote access to the affected device's management interfaces to trusted networks only. Monitor vendor communications for updates on patches or mitigations.