The vulnerability CVE-2026-6137 affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. It is a stack-based buffer overflow triggered by manipulating the wanmode or PPPOEPassword parameters in the fromAdvSetWan function of the /goform/AdvSetWan endpoint. The vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits in the wild have been confirmed.

Successful exploitation can lead to remote code execution or denial of service on affected Tenda F451 devices, compromising device confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of widespread impact. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if enabled or isolate the device from untrusted networks to reduce exposure. Monitor official Tenda communications for updates on patches or mitigations.