The vulnerability CVE-2026-6122 affects Tenda F451 version 1.0.0.7 and involves a stack-based buffer overflow in the frmL7ProtForm function of the /goform/L7Prot endpoint in the httpd component. An attacker can remotely trigger this overflow by manipulating the 'page' argument, which may lead to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known but no official fix or mitigation has been documented.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow on the affected device, potentially leading to arbitrary code execution or denial of service. Given the network attack vector and lack of required privileges or user interaction, the risk is significant for devices running the vulnerable firmware version. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for any updates from Tenda regarding patches or mitigations. No vendor advisory or official remediation instructions are currently available.