CVE-2026-5045
Published: 29 March 2026
Summary
CVE-2026-5045 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Fh1201 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the stack-based buffer overflow in the WrlclientSet function of Tenda FH1201 firmware 1.2.0.14(408) through timely flaw patching.
Validates the manipulated GO argument in the /goform/WrlclientSet endpoint to prevent the buffer overflow.
Implements memory protections like stack canaries to block arbitrary code execution from the stack-based buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in exposed /goform web endpoint enables remote exploitation of a public-facing application (T1190) by low-privileged authenticated users, directly resulting in arbitrary code execution and privilege escalation to root/full device control (T1068).
NVD Description
A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer overflow. The attack is possible to be…
more
carried out remotely. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-5045 is a stack-based buffer overflow vulnerability in the Tenda FH1201 router running firmware version 1.2.0.14(408). The issue affects the WrlclientSet function within the /goform/WrlclientSet endpoint of the Parameter Handler component, triggered by manipulating the GO argument. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, granting high impacts on confidentiality, integrity, and availability, potentially leading to full device compromise such as root access or persistent control.
Advisories from VulDB (vuln/353968) and a public exploit on GitHub detail the vulnerability, while the Tenda website (tenda.com.cn) serves as the vendor reference for potential updates. No specific patches are mentioned in the available information, urging practitioners to monitor these sources for mitigation guidance.
The exploit is publicly available, increasing the risk of real-world attacks against unpatched Tenda FH1201 devices.
Details
- CWE(s)