{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-6123/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-6123"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["cve-2026-6123","tenda","router","buffer-overflow","iot"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical stack-based buffer overflow vulnerability has been identified in Tenda F451 router firmware version 1.0.0.7. The vulnerability resides in the \u003ccode\u003efromAddressNat\u003c/code\u003e function within the \u003ccode\u003e/goform/addressNat\u003c/code\u003e component's \u003ccode\u003ehttpd\u003c/code\u003e service. An attacker can trigger the overflow by crafting a malicious payload and sending it as the \u003ccode\u003eentrys\u003c/code\u003e argument in a request to the router. Publicly available exploits exist, increasing the risk of widespread exploitation. This vulnerability allows for remote, unauthenticated code execution, potentially enabling attackers to compromise the device and gain control of the network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Tenda F451 router running firmware version 1.0.0.7.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting the \u003ccode\u003e/goform/addressNat\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe HTTP request includes a specifically crafted \u003ccode\u003eentrys\u003c/code\u003e argument designed to overflow the stack buffer in the \u003ccode\u003efromAddressNat\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehttpd\u003c/code\u003e service on the Tenda router receives the malicious request and processes the \u003ccode\u003eentrys\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efromAddressNat\u003c/code\u003e function copies the attacker-controlled data from the \u003ccode\u003eentrys\u003c/code\u003e argument into a fixed-size stack buffer without proper bounds checking.\u003c/li\u003e\n\u003cli\u003eThe oversized data overflows the stack buffer, overwriting adjacent memory locations, including the return address.\u003c/li\u003e\n\u003cli\u003eThe function returns, but instead of returning to the caller, it jumps to an address controlled by the attacker, effectively executing arbitrary code.\u003c/li\u003e\n\u003cli\u003eThe attacker gains remote code execution on the Tenda F451 router, potentially leading to full device compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants attackers complete control over the affected Tenda F451 router. This could lead to a number of severe consequences, including: unauthorized access to the local network, data theft, malware installation, and use of the compromised router as part of a botnet. Given the simplicity of exploitation (public exploit available) and the potentially wide deployment of the affected router model, a successful attack may affect a significant number of users and small businesses.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Tenda F451 Stack Buffer Overflow Attempt\u0026quot; to detect exploitation attempts targeting the \u003ccode\u003e/goform/addressNat\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for suspicious requests with unusually long \u003ccode\u003eentrys\u003c/code\u003e parameters in the \u003ccode\u003e/goform/addressNat\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eConsider blocking or rate-limiting traffic to the \u003ccode\u003e/goform/addressNat\u003c/code\u003e endpoint if legitimate use is not required.\u003c/li\u003e\n\u003cli\u003eIf possible, replace any Tenda F451 routers running firmware version 1.0.0.7 with more secure devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-12T09:17:19Z","date_published":"2026-04-12T09:17:19Z","id":"https://feed.craftedsignal.io/briefs/2026-04-16-tenda-f451-bo/","summary":"A stack-based buffer overflow vulnerability exists in Tenda F451 version 1.0.0.7 within the fromAddressNat function of the /goform/addressNat component, allowing for remote exploitation by manipulating the 'entrys' argument.","title":"Tenda F451 Router Stack-Based Buffer Overflow Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-16-tenda-f451-bo/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-6123","version":"https://jsonfeed.org/version/1.1"}