CVE-2026-6632
Published: 20 April 2026
Summary
CVE-2026-6632 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Com (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-6632 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting the Tenda F451 router on firmware version 1.0.0.7_cn_svn7958. The flaw exists in the fromSafeClientFilter function within the /goform/SafeClientFilter file of the httpd component, triggered by manipulation of the "menufacturer/Go" argument. Published on 2026-04-20, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), marking it as high severity.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing full compromise of the affected device.
Advisories provide further details at https://github.com/Jimi-Lab/cve/issues/26, https://vuldb.com/submit/792905, https://vuldb.com/vuln/358266, https://vuldb.com/vuln/358266/cti, and https://www.tenda.com.cn/. Mitigation guidance, including any patches, should be referenced from these sources.
A public exploit is available and might be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23830
Vulnerability details
A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. Remote exploitation of the attack is possible.…
more
The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the httpd web interface (/goform/SafeClientFilter) allows remote low-privileged attackers to achieve full device compromise, directly enabling exploitation of a public-facing application (T1190) and privilege escalation via software vulnerability (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow vulnerability by requiring identification, reporting, and patching of the specific flaw in the httpd component.
Information input validation enforces checks on the 'menufacturer/Go' argument in the fromSafeClientFilter function to prevent buffer overflow exploitation.
Memory protection implements safeguards like address space layout randomization and non-executable stacks to mitigate unauthorized code execution from buffer overflows.