Tenda F451 qossetting fromqossetting stack-based overflow

The stack-based buffer overflow vulnerability in the Tenda F451 allows attackers to send specially crafted requests to the /goform/qossetting endpoint, manipulating the qos argument. This manipulation can overwrite critical memory regions on the router, leading to a crash or, more seriously, allowing the attacker to inject and execute malicious code. Given the router's role as a network gateway, a successful exploit could provide an attacker with access to the internal network, enabling them to intercept traffic, steal sensitive data, or launch further attacks against connected devices. The availability of a public exploit significantly elevates the risk, as it lowers the barrier to entry for malicious actors.

Small businesses and home users relying on Tenda F451 routers are at risk. Shared hosting environments utilizing these routers as gateway devices are particularly vulnerable, as a compromise of the router could expose multiple tenants to attack. Users with older, unpatched firmware versions are most susceptible.

• linux / server:

journalctl -f -u tenda_qos | grep -i overflow

• generic web:

curl -v https://<router_ip>/goform/qossetting?qos=AAAAAAAAAAAAAAAAAAAAAAA | grep -i 'stack overflow'

1. 2026-04-12Disclosure

   disclosure

2. 2026-04-12PoC

   poc

1. Reserviert2026-04-12
2. Veröffentlicht2026-04-12
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-20

The primary mitigation for CVE-2026-6134 is to upgrade the Tenda F451 router to a firmware version that addresses the buffer overflow vulnerability. Unfortunately, a fixed firmware version is not yet specified. Until a patch is available, consider implementing temporary workarounds such as restricting access to the /goform/qossetting endpoint using a firewall or access control list (ACL). Monitoring network traffic for unusual patterns or connections to suspicious IP addresses can also help detect potential exploitation attempts. After applying any mitigation, verify its effectiveness by attempting to reproduce the vulnerability with a safe test payload.