CVE-2026-6136

CVE-2026-6136 is a stack-based buffer overflow vulnerability in Tenda F451 router firmware version 1.0.0.7_cn_svn7958, specifically within the frmL7ImForm function of the /goform/L7Im endpoint. The vulnerability is triggered through manipulation of the page parameter and can be exploited remotely. The vulnerability carries a HIGH CVSS score of 8.8, requiring only low attack complexity and standard user-level privileges to execute. The attack vector is network-based with no user interaction required, and successful exploitation could result in complete system compromise including confidentiality breach, integrity violation, and service disruption. While exploit code has been publicly disclosed, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The EPSS score of 0.00048 indicates low probability of exploitation in the near term, though organizations running affected Tenda router models should prioritize patching given the ease of remote exploitation and disclosed proof-of-concept availability.