The vulnerability CVE-2026-6136 affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. It is a stack-based buffer overflow in the frmL7ImForm function of the /goform/L7Im file, triggered by manipulation of the 'page' argument. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a high-impact security issue. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no vendor patch or official remediation is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected device, potentially leading to full compromise of the router. This could impact the confidentiality, integrity, and availability of the device and the network it serves. No evidence of exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to the management interface. Monitor vendor channels for updates and apply patches promptly once available.