{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-6124/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-6124"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["cve-2026-6124","buffer-overflow","router","tenda"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA stack-based buffer overflow vulnerability has been identified in Tenda F451 version 1.0.0.7. This flaw resides in the \u003ccode\u003efromSafeMacFilter\u003c/code\u003e function of the \u003ccode\u003e/goform/SafeMacFilter\u003c/code\u003e file within the \u003ccode\u003ehttpd\u003c/code\u003e component. Successful exploitation allows a remote attacker to execute arbitrary code on the affected device. The vulnerability is triggered by manipulating the \u003ccode\u003epage/menufacturer\u003c/code\u003e argument. Publicly available exploits exist, increasing the risk of widespread exploitation. Routers are often exposed to the internet, making them attractive targets for attackers looking to gain unauthorized access to networks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a crafted HTTP GET request to the \u003ccode\u003e/goform/SafeMacFilter\u003c/code\u003e endpoint of the Tenda F451 router.\u003c/li\u003e\n\u003cli\u003eThe request includes a malicious payload within the \u003ccode\u003epage/menufacturer\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehttpd\u003c/code\u003e component receives the request and passes the \u003ccode\u003epage/menufacturer\u003c/code\u003e argument to the \u003ccode\u003efromSafeMacFilter\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efromSafeMacFilter\u003c/code\u003e function does not properly validate the length of the \u003ccode\u003epage/menufacturer\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eDue to the missing validation, the supplied payload overflows the stack buffer.\u003c/li\u003e\n\u003cli\u003eThe overflow overwrites critical data on the stack, including the return address.\u003c/li\u003e\n\u003cli\u003eUpon function return, control is transferred to the attacker's payload.\u003c/li\u003e\n\u003cli\u003eThe attacker's payload executes with elevated privileges, allowing for complete control of the device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Tenda F451 router. This can lead to a variety of malicious outcomes, including complete device compromise, denial of service, and potential network intrusion. Given that this exploit is publicly available, a large number of unpatched Tenda F451 routers are at risk. Attackers could leverage compromised devices for botnet activities, data exfiltration, or lateral movement within a network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply available patches or firmware updates for Tenda F451 routers to remediate CVE-2026-6124.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs (category: webserver, product: linux) for suspicious requests to \u003ccode\u003e/goform/SafeMacFilter\u003c/code\u003e containing unusually long \u003ccode\u003epage\u003c/code\u003e or \u003ccode\u003emenufacturer\u003c/code\u003e parameters, as detected by the provided Sigma rule.\u003c/li\u003e\n\u003cli\u003eImplement network intrusion detection systems (IDS) and intrusion prevention systems (IPS) rules to detect and block exploitation attempts targeting CVE-2026-6124.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-12T09:16:18Z","date_published":"2026-04-12T09:16:18Z","id":"https://feed.craftedsignal.io/briefs/2026-04-12-tenda-stack-overflow/","summary":"A stack-based buffer overflow vulnerability in Tenda F451 version 1.0.0.7 allows remote attackers to execute arbitrary code by manipulating the 'page/menufacturer' argument in the fromSafeMacFilter function.","title":"Tenda F451 Stack-Based Buffer Overflow Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-12-tenda-stack-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-6124","version":"https://jsonfeed.org/version/1.1"}