CVE-2026-5992
Published: 10 April 2026
Summary
CVE-2026-5992 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F451 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5992 is a stack-based buffer overflow vulnerability affecting the Tenda F451 router firmware version 1.0.0.7. The issue resides in the fromP2pListFilter function within the /goform/P2pListFilter file, where manipulation of the "page" argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables high-impact outcomes on confidentiality, integrity, and availability, including potential remote code execution via the buffer overflow.
Advisories referenced in VulDB entries (vuln/356546 and related CTI/submit pages) and a GitHub issue in Jimi-Lab/cve describe the vulnerability and note that the exploit has been publicly disclosed and may be utilized. The Tenda manufacturer's website (tenda.com.cn) is listed among references, though specific patch details are not detailed in the provided information.
The exploit's public disclosure increases the risk of active utilization against unpatched Tenda F451 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21246
Vulnerability details
A vulnerability was determined in Tenda F451 1.0.0.7. This affects the function fromP2pListFilter of the file /goform/P2pListFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed…
more
and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing web form (/goform/P2pListFilter) on router enables remote code execution via exploitation of a network-exposed application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow in the fromP2pListFilter function by applying firmware patches or updates for the Tenda F451.
Validates the 'page' argument at the web interface entry point to prevent manipulation that triggers the buffer overflow.
Implements runtime memory safeguards like stack canaries or non-executable stacks to block code execution from the buffer overflow exploit.