Threat database

A vulnerability has been found in Tenda F453 up to 1.0.0.3. Impacted is the function TendaTelnet of the file /goform/telnet of the component Telnet Service. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. Performing a manipulation of the argument dips results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2026-6200 is a high-severity stack-based buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It exists in the function formwebtypelibrary within the /goform/webtypelibrary file, triggered by manipulating the menufacturer/Go argument. The vulnerability can be exploited remotely without user interaction or privileges. Although the exploit has been publicly disclosed, there are no known exploits in the wild and no official patch or remediation guidance has been provided yet.

A vulnerability was found in Tenda F456 1.0.0.5. Impacted is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVE-2026-6198 is a high-severity stack-based buffer overflow vulnerability in Tenda F456 version 1.0.0.5. The flaw exists in the fromNatStaticSetting function within the /goform/NatStaticSetting file, where improper handling of the 'page' argument can lead to a buffer overflow. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit code has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.

A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mit_ssid can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

A vulnerability was detected in Tenda F456 1.0.0.5. This affects the function fromexeCommand of the file /goform/exeCommand. Performing a manipulation of the argument cmdinput results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-6137 is a high-severity stack-based buffer overflow vulnerability in the Tenda F451 router firmware version 1.0.0.7_cn_svn7958. The flaw exists in the fromAdvSetWan function within the /goform/AdvSetWan file, where improper handling of the wanmode or PPPOEPassword argument can lead to a stack-based buffer overflow. This vulnerability can be exploited remotely without user interaction. Although a public exploit is available, there is no confirmed patch or official remediation at this time.

A security vulnerability has been detected in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-6135 is a high-severity stack-based buffer overflow vulnerability in the Tenda F451 router firmware version 1.0.0.7_cn_svn7958. The flaw exists in the fromSetIpBind function within the /goform/SetIpBind file, where improper handling of the 'page' argument can lead to a buffer overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although an exploit is publicly available, there are no known reports of active exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A security flaw has been discovered in Tenda F451 1.0.0.7_cn_svn7958. This vulnerability affects the function fromqossetting of the file /goform/qossetting. Performing a manipulation of the argument qos results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-6133 is a stack-based buffer overflow vulnerability in the Tenda F451 router firmware version 1.0.0.7_cn_svn7958. It occurs in the fromSafeUrlFilter function within the /goform/SafeUrlFilter file when the 'page' argument is manipulated. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The vulnerability has a high severity with a CVSS score of 8.7. There is no official patch or remediation information currently available from the vendor. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild at this time.

A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-6123 is a high-severity stack-based buffer overflow vulnerability in Tenda F451 version 1.0.0.7. It affects the fromAddressNat function in the /goform/addressNat component of the httpd service. The vulnerability arises from improper handling of the argument 'entrys', allowing remote attackers to cause a buffer overflow. Exploit code has been publicly disclosed, but no confirmed exploits in the wild have been reported. No official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in Tenda F451 1.0.0.7. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Such manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-6121 is a high-severity stack-based buffer overflow vulnerability in Tenda F451 version 1.0.0.7. It exists in the httpd component's WrlclientSet function, specifically in the /goform/WrlclientSet endpoint. The vulnerability is triggered by manipulation of the GO argument, allowing remote attackers to cause a buffer overflow. An exploit has been published, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-6120 is a high-severity stack-based buffer overflow vulnerability in Tenda F451 version 1.0.0.7. It affects the fromDhcpListClient function within the httpd component, specifically in the /goform/DhcpListClient file. The vulnerability arises from improper handling of the 'page' argument, allowing remote attackers to trigger a stack-based buffer overflow. Exploits for this vulnerability are publicly available. No official patch or remediation guidance has been provided by the vendor as of the publication date.