Tenda Router Vulnerability Exposes Networks to Remote Exploitation

The National Vulnerability Database has identified CVE-2026-6632, a critical buffer overflow vulnerability in Tenda F451 routers running firmware version 1.0.0.7_cn_svn7958. The flaw resides in the httpd component’s /goform/SafeClientFilter function, allowing remote attackers to exploit it by manipulating the menufacturer/Go argument. This grants attackers the ability to trigger a buffer overflow, potentially leading to a full compromise of the affected device.

With a CVSS score of 8.8 (HIGH) and a publicly available exploit, this vulnerability presents a significant risk to users. The ease of remote exploitation and the lack of specific affected product details beyond the firmware version mean that any organization utilizing these routers should consider them at immediate risk. Defenders must prioritize identifying and securing these devices within their networks.