CVE-2026-5992

BRIEFING NOTE: CVE-2026-5992 A stack-based buffer overflow vulnerability has been identified in Tenda F451 firmware version 1.0.0.7, specifically in the fromP2pListFilter function of the /goform/P2pListFilter endpoint. The vulnerability is triggered through manipulation of the page parameter and allows remote attackers to execute arbitrary code. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and low privilege access. The potential impact is severe, affecting confidentiality, integrity, and availability. Notably, successful exploitation requires authenticated access, which somewhat limits opportunistic attacks. Public exploit code has been disclosed for this vulnerability, increasing risk exposure across deployed Tenda F451 devices. The EPSS score of 0.000480 indicates relatively low predicted exploitation probability in the wild. The vulnerability is not currently listed on the CISA KEV catalog, and community attention appears limited, though the moderate FAUCET Risk Score of 51.0 warrants monitoring.