CVE-2026-11556

HighCVSS 8.8

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.61%

73th percentile - higher than 73% of all known CVEs

Summary

A command injection vulnerability was found in Tenda F451 versions 1.0.0.7 and 1.0.0.9 in the formWriteFacMac function of /goform/WriteFacMac. The attack can be performed remotely. The exploit has been published.

Risk Assessment

A remote attacker can execute arbitrary system commands on the device, leading to full compromise of the router.

Recommendation

Update the router firmware to the latest version if available, or apply other mitigations.

Other vulnerabilities in Tenda F451

CVE-2026-11557High
Vulnerability in Tenda F451 (versions 1.0.0.7/1.0.0.9) in the fromNatlimit function of the web management interface. Manipulation of the page argument leads to stack-based buffer overflow, enabling remote attack.

Original NVD description (English source)

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.