CVE-2026-11557

HighCVSS 8.8

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

Vulnerability in Tenda F451 (versions 1.0.0.7/1.0.0.9) in the fromNatlimit function of the web management interface. Manipulation of the page argument leads to stack-based buffer overflow, enabling remote attack.

Risk Assessment

Risk of remote code execution or device disruption on Tenda F451.

Recommendation

Update Tenda F451 firmware to the latest version. Restrict access to the management interface to trusted networks.

Other vulnerabilities in Tenda F451

CVE-2026-11556High
A command injection vulnerability was found in Tenda F451 versions 1.0.0.7 and 1.0.0.9 in the formWriteFacMac function of /goform/WriteFacMac. The attack can be performed remotely. The exploit has been published.

Original NVD description (English source)

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.