The vulnerability CVE-2026-5992 affects Tenda F451 firmware version 1.0.0.7. It is a stack-based buffer overflow triggered by improper handling of the 'page' argument in the fromP2pListFilter function located in /goform/P2pListFilter. This flaw can be exploited remotely without authentication or user interaction, potentially leading to high-impact consequences such as arbitrary code execution. The CVSS 4.0 base score is 8.7, reflecting its high severity and ease of exploitation. No official patch or vendor advisory is currently available, and no known exploits in the wild have been confirmed.

Successful exploitation of this vulnerability can lead to remote code execution on affected devices, compromising device integrity and potentially allowing attackers to control the device or disrupt its operation. The vulnerability requires no user interaction and can be triggered remotely, increasing the risk. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.