CVE-2026-5989
Published: 10 April 2026
Summary
CVE-2026-5989 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F451 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5989 is a stack-based buffer overflow vulnerability affecting the Tenda F451 router on firmware version 1.0.0.7. The flaw resides in the fromRouteStatic function within the /goform/RouteStatic file, where manipulation of the "page" argument triggers the overflow.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high impacts on confidentiality, integrity, and availability, as scored 8.8 in CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially enabling remote code execution. The issue maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Advisories and details are documented in references such as the GitHub issue at https://github.com/Jimi-Lab/cve/issues/5, VulDB entries at https://vuldb.com/vuln/356543 and related pages, and the vendor site at https://www.tenda.com.cn/. No specific mitigation or patch guidance is provided in the initial disclosure.
An exploit for this vulnerability has been published and may be used, published on 2026-04-10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21239
Vulnerability details
A flaw has been found in Tenda F451 1.0.0.7. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has…
more
been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the public web interface (/goform/RouteStatic) of the Tenda router directly enables remote code execution by adversaries exploiting a public-facing application over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and error handling of inputs like the 'page' argument at web endpoints such as /goform/RouteStatic to directly prevent stack buffer overflows from improper restrictions.
Implements memory protections like stack canaries and address space randomization to mitigate exploitation of stack-based buffer overflows even if input validation fails.
Mandates timely identification, reporting, and patching of flaws like this buffer overflow in router firmware to eliminate the vulnerability.