CVE-2026-6120: Stack Overflow in Tenda F451 Router

The vulnerability lies within the /goform/DhcpListClient file, specifically in the fromDhcpListClient function. By manipulating the page argument, an attacker can trigger a buffer overflow, overwriting memory on the stack. This can lead to a denial-of-service condition, crashing the router and disrupting network connectivity. More concerningly, a successful buffer overflow could allow an attacker to execute arbitrary code on the router, gaining complete control over the device. This could be used to intercept network traffic, modify router configurations, or launch further attacks against other devices on the network. The existence of a public exploit significantly increases the likelihood of exploitation.

1. Reserved2026-04-11
2. Published2026-04-12
3. Modified2026-04-13
4. EPSS updated2026-04-19

The primary mitigation for CVE-2026-6120 is to upgrade the Tenda F451 router to a firmware version that addresses this vulnerability. Unfortunately, a fixed firmware version is not currently specified. Until a patch is released, consider implementing temporary workarounds to reduce the attack surface. These might include restricting access to the router's web interface from untrusted networks, enabling a firewall to block suspicious traffic, and monitoring router logs for unusual activity. If a rollback to a previous, more secure firmware version is possible, that could also be considered. After applying any mitigation, verify its effectiveness by attempting to trigger the vulnerability (if safe to do so in a test environment) or by reviewing router logs for any signs of exploitation attempts.