Tenda F451 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in Tenda F451 version 1.0.0.7. This flaw resides in the fromSafeMacFilter function of the /goform/SafeMacFilter file within the httpd component. Successful exploitation allows a remote attacker to execute arbitrary code on the affected device. The vulnerability is triggered by manipulating the page/menufacturer argument. Publicly available exploits exist, increasing the risk of widespread exploitation. Routers are often exposed to the internet, making them attractive targets for attackers looking to gain unauthorized access to networks.

Attack Chain

1. Attacker sends a crafted HTTP GET request to the /goform/SafeMacFilter endpoint of the Tenda F451 router.
2. The request includes a malicious payload within the page/menufacturer argument.
3. The httpd component receives the request and passes the page/menufacturer argument to the fromSafeMacFilter function.
4. The fromSafeMacFilter function does not properly validate the length of the page/menufacturer argument.
5. Due to the missing validation, the supplied payload overflows the stack buffer.
6. The overflow overwrites critical data on the stack, including the return address.
7. Upon function return, control is transferred to the attacker's payload.
8. The attacker's payload executes with elevated privileges, allowing for complete control of the device.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Tenda F451 router. This can lead to a variety of malicious outcomes, including complete device compromise, denial of service, and potential network intrusion. Given that this exploit is publicly available, a large number of unpatched Tenda F451 routers are at risk. Attackers could leverage compromised devices for botnet activities, data exfiltration, or lateral movement within a network.

Recommendation

• Apply available patches or firmware updates for Tenda F451 routers to remediate CVE-2026-6124.
• Monitor web server logs (category: webserver, product: linux) for suspicious requests to /goform/SafeMacFilter containing unusually long page or menufacturer parameters, as detected by the provided Sigma rule.
• Implement network intrusion detection systems (IDS) and intrusion prevention systems (IPS) rules to detect and block exploitation attempts targeting CVE-2026-6124.