Tenda F451 Router Hit by Remote Buffer Overflow

The National Vulnerability Database (NVD) has flagged a critical security flaw, CVE-2026-6134, impacting the Tenda F451 router, specifically version 1.0.0.7_cn_svn7958. This isn’t just a theoretical bug; it’s a stack-based buffer overflow stemming from improper handling of the qos argument within the fromqossetting function of the /goform/qossetting file.

What makes this particularly nasty is its remote exploitability. An attacker doesn’t need physical access or even to be on the local network. They can trigger this overflow remotely, potentially leading to arbitrary code execution or a denial of service. With a CVSS score of 8.8 (HIGH), this vulnerability is a serious concern, especially since, according to the NVD, an exploit has already been released to the public. This means it’s not a matter of ‘if’ but ‘when’ it gets weaponized in the wild.