Tenda F451 Router Hit by Remote Buffer Overflow
The National Vulnerability Database (NVD) has flagged a critical vulnerability, CVE-2026-6120, affecting the Tenda F451 router, specifically version 1.0.0.7. This bug resides within the fromDhcpListClient function of the /goform/DhcpListClient file, handled by the device’s httpd component.
According to the NVD, a crafted page argument can trigger a stack-based buffer overflow, allowing for remote exploitation. With a CVSS score of 8.8 (HIGH), this isn’t some minor bug; it’s a serious remote code execution vector. The NVD further notes that an exploit for this vulnerability is already public, meaning script kiddies and seasoned threat actors alike could be leveraging it right now. This is a classic CWE-119/CWE-121 scenario, underscoring the persistent danger of improper buffer handling in embedded systems.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 5 SIEM formats3 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, and QRadar AQL.
Web Application Exploitation Attempt — CVE-2026-6120
Get this rule in your SIEM's native format — copy, paste, detect. No manual conversion.
3 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.
Get Detection Rules →Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6120 | Buffer Overflow | Tenda F451 version 1.0.0.7 |
| CVE-2026-6120 | Buffer Overflow | Vulnerable component: httpd |
| CVE-2026-6120 | Buffer Overflow | Vulnerable file: /goform/DhcpListClient |
| CVE-2026-6120 | Buffer Overflow | Vulnerable function: fromDhcpListClient |
| CVE-2026-6120 | Buffer Overflow | Vulnerable argument: page (leading to stack-based buffer overflow) |
Related Posts
Critical RCE Flaw Hits NuGet Gallery Backend
CVE-2026-39399 — NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within...
BoidCMS LFI to RCE: A Critical Template Flaw
CVE-2026-39387 — BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are...
Nanobot AI: WebSocket Hijack Puts WhatsApp Sessions at Risk
CVE-2026-35589 — nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server...