CVE-2026-6133
Published: 12 April 2026
Summary
CVE-2026-6133 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F451 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the 'page' argument in /goform/SafeUrlFilter to prevent stack-based buffer overflow from unsafe input manipulation.
Enforces memory protections like stack canaries, ASLR, and DEP to mitigate successful exploitation of the stack-based buffer overflow even if input validation fails.
Mandates timely patching of the buffer overflow vulnerability in Tenda F451 firmware version 1.0.0.7_cn_svn7958 to eliminate the flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the public-facing web form handler (/goform/SafeUrlFilter) of the router firmware allows remote low-privilege authenticated attackers to achieve arbitrary code execution with high impact, directly mapping to exploitation of public-facing applications (T1190) and exploitation for privilege escalation (T1068).
NVD Description
A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. This affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and…
more
might be used.
Deeper analysisAI
CVE-2026-6133, published on 2026-04-12, is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting the fromSafeUrlFilter function in the /goform/SafeUrlFilter file of Tenda F451 firmware version 1.0.0.7_cn_svn7958. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Remote attackers with low privileges, such as authenticated users, can exploit the vulnerability by manipulating the "page" argument, leading to a stack-based buffer overflow. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution. A public exploit is available and might be used in attacks.
Advisories and additional details are available from VulDB entries (https://vuldb.com/vuln/356997, https://vuldb.com/vuln/356997/cti, https://vuldb.com/submit/792875) and a GitHub issue (https://github.com/Jimi-Lab/cve/issues/17). The vendor website is at https://www.tenda.com.cn/.
Details
- CWE(s)