The vulnerability CVE-2026-6135 affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. It arises from a stack-based buffer overflow in the fromSetIpBind function of the /goform/SetIpBind endpoint. An attacker can remotely manipulate the 'page' argument to trigger the overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda F451 device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. The presence of a public exploit increases the risk of attacks, although no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor Tenda's advisories for updates. Until a patch is available, restricting network access to the device's management interface and applying network-level protections may reduce exposure.