CVE-2026-6124
Published: 12 April 2026
Summary
CVE-2026-6124 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Com (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-6124 is a stack-based buffer overflow vulnerability affecting the Tenda F451 router on firmware version 1.0.0.7. The flaw resides in the fromSafeMacFilter function within the /goform/SafeMacFilter file of the httpd component. It is triggered by manipulating the page/menufacturer argument, as determined and published on April 12, 2026.
The vulnerability enables remote exploitation by an attacker with low privileges over the network, requiring low attack complexity and no user interaction. Per the CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially leading to arbitrary code execution through the buffer overflow.
Advisories and further details are available via references including VulDB entries (https://vuldb.com/vuln/356987, https://vuldb.com/submit/792874, https://vuldb.com/vuln/356987/cti), a GitHub disclosure (https://github.com/Jimi-Lab/cve/issues/16), and the Tenda vendor site (https://www.tenda.com.cn/). The exploit has been publicly disclosed and may be utilized, with associations to CWE-119 and CWE-121.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21726
Vulnerability details
A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed…
more
remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable stack-based buffer overflow in the public-facing httpd web interface (with low privileges required), directly enabling T1190 for initial access via public-facing application exploitation and T1068 for privilege escalation to achieve arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow vulnerability in the Tenda F451 httpd component by applying firmware patches or updates.
Validates manipulated inputs like the page/menufacturer argument in /goform/SafeMacFilter to prevent triggering the buffer overflow.
Implements memory protections such as stack canaries and non-executable memory to block arbitrary code execution from the stack buffer overflow.