The vulnerability CVE-2026-6632 affects Tenda F451 firmware version 1.0.0.7_cn_svn7958. It is a buffer overflow in the fromSafeClientFilter function of the /goform/SafeClientFilter HTTP daemon component. The issue arises from improper handling of the menufacturer/Go argument, which can be manipulated remotely to overflow a buffer. This vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact metrics. Although a public exploit exists, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this buffer overflow vulnerability could allow remote attackers to execute arbitrary code or cause denial of service on the affected Tenda F451 device. The vulnerability impacts confidentiality, integrity, and availability with high severity. Since the attack requires no privileges or user interaction and can be performed remotely, the risk to affected devices is significant. However, there are no confirmed reports of exploitation in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by Tenda for this vulnerability. Until a patch is available, affected users should consider limiting network exposure of the device's management interface and monitor for any unusual activity. Follow vendor channels closely for updates on remediation.