Attack Chain

1. Attacker sends a crafted HTTP GET request to the /goform/SafeMacFilter endpoint of the Tenda F451 router.
2. The request includes a malicious payload within the page/menufacturer argument.
3. The httpd component receives the request and passes the page/menufacturer argument to the fromSafeMacFilter function.
4. The fromSafeMacFilter function does not properly validate the length of the page/menufacturer argument.
5. Due to the missing validation, the supplied payload overflows the stack buffer.
6. The overflow overwrites critical data on the stack, including the return address.
7. Upon function return, control is transferred to the attacker's payload.
8. The attacker's payload executes with elevated privileges, allowing for complete control of the device.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Tenda F451 router. This can lead to a variety of malicious outcomes, including complete device compromise, denial of service, and potential network intrusion. Given that this exploit is publicly available, a large number of unpatched Tenda F451 routers are at risk. Attackers could leverage compromised devices for botnet activities, data exfiltration, or lateral movement within a network.

Recommendation

• Apply available patches or firmware updates for Tenda F451 routers to remediate CVE-2026-6124.
• Monitor web server logs (category: webserver, product: linux) for suspicious requests to /goform/SafeMacFilter containing unusually long page or menufacturer parameters, as detected by the provided Sigma rule.
• Implement network intrusion detection systems (IDS) and intrusion prevention systems (IPS) rules to detect and block exploitation attempts targeting CVE-2026-6124.