Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow

The vulnerability allows a remote attacker to execute arbitrary code on the affected Tenda F451 router. By crafting a malicious request targeting the /goform/SafeUrlFilter endpoint, an attacker can overwrite memory on the stack, potentially gaining control of the device. Successful exploitation could lead to complete system compromise, including data theft, configuration modification, and the use of the router as a pivot point for further attacks within the network. The availability of a public exploit significantly elevates the risk, making it a high-priority concern.

Small and medium-sized businesses (SMBs) and home users who rely on Tenda F451 routers for their network connectivity are at significant risk. Shared hosting environments where multiple users share a single router are particularly vulnerable, as a compromise of one router could potentially impact all users.

• linux / server:

journalctl -u tenda_safeurlfilter -f | grep -i overflow

• generic web:

curl -I <router_ip>/goform/SafeUrlFilter?page=<malicious_input>

Inspect the response headers and body for any errors or unusual behavior. • linux / server:

lsof -i :80 | grep tenda

Check for unusual processes listening on port 80 associated with the Tenda router.

1. 2026-04-12Disclosure

   disclosure

1. 予約済み2026-04-12
2. 公開日2026-04-12
3. 更新日2026-04-13
4. EPSS 更新日2026-04-20

The primary mitigation is to upgrade the Tenda F451 firmware to a patched version. Unfortunately, a fixed version is not yet specified in the CVE details. As a temporary workaround, consider implementing strict input validation on the 'page' parameter within the /goform/SafeUrlFilter endpoint, if possible. Network segmentation can limit the potential blast radius of a successful exploit. Monitor router logs for unusual activity or attempts to access the /goform/SafeUrlFilter endpoint. A WAF configured to detect buffer overflow attempts targeting this endpoint could also provide some protection.