CVE-2026-5989

CVE-2026-5989 is a stack-based buffer overflow vulnerability affecting Tenda F451 router firmware version 1.0.0.7. The flaw exists in the fromRouteStatic function of the /goform/RouteStatic endpoint, where improper validation of the page parameter allows remote code execution. This vulnerability carries a CVSS score of 8.8 (HIGH), indicating significant risk. It requires network accessibility and low-privilege user authentication but poses no complexity for exploitation. Successful attacks could result in complete compromise of confidentiality, integrity, and availability on affected systems. Currently, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no indication of active exploitation. However, proof-of-concept exploit code has been publicly disclosed, which increases the risk of opportunistic attacks. The relatively low EPSS score of 0.00048 suggests limited near-term exploitation probability, though the published exploit nature warrants timely patching for organizations using vulnerable Tenda F451 devices.