The vulnerability CVE-2026-6137 affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. It is a stack-based buffer overflow in the fromAdvSetWan function of the /goform/AdvSetWan file, triggered by manipulating the wanmode or PPPOEPassword arguments. The issue allows remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability allows remote attackers to trigger a stack-based buffer overflow, which can lead to arbitrary code execution or denial of service on the affected device. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability. The exploit is publicly available, increasing the risk of attacks, although no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device's management interface and monitor for unusual activity. Avoid exposing the device management interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.