CVE-2026-6134
Published: 12 April 2026
Summary
CVE-2026-6134 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F451 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-6134 is a stack-based buffer overflow vulnerability in the Tenda F451 router running firmware version 1.0.0.7_cn_svn7958. The flaw resides in the fromqossetting function within the /goform/qossetting endpoint, where manipulation of the qos argument triggers the overflow. It is remotely exploitable and has been assigned CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges, such as a remote authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device due to the nature of the stack-based buffer overflow.
Advisories and related resources, including a GitHub issue at https://github.com/Jimi-Lab/cve/issues/18 detailing the exploit, VulDB entries at https://vuldb.com/vuln/356998 and https://vuldb.com/submit/792876, and the manufacturer's site at https://www.tenda.com.cn/, provide further details. An exploit has been publicly released, enabling potential attacks on unpatched devices.
Security practitioners should note that the public availability of the exploit increases the risk of real-world exploitation against exposed Tenda F451 routers on this firmware version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21752
Vulnerability details
A security flaw has been discovered in Tenda F451 1.0.0.7_cn_svn7958. This vulnerability affects the function fromqossetting of the file /goform/qossetting. Performing a manipulation of the argument qos results in stack-based buffer overflow. The attack is possible to be carried out…
more
remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the router's public-facing /goform/qossetting web endpoint is remotely exploitable by low-privilege authenticated users to achieve arbitrary code execution, directly enabling T1190 (Exploit Public-Facing Application) as the attack vector and T1068 (Exploitation for Privilege Escalation) due to the transition from low privileges to full system control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the stack-based buffer overflow flaw in the Tenda F451 firmware.
Mandates validation of the qos argument at the /goform/qossetting endpoint to prevent the buffer overflow exploitation.
Implements memory safeguards such as stack canaries to protect against unauthorized code execution from the stack-based buffer overflow.