CVE-2026-11556: Tenda F451 Router RCE Vulnerability

CVE-2026-11556 Overview

CVE-2026-11556 is an operating system command injection vulnerability affecting the Tenda F451 router running firmware versions 1.0.0.7 and 1.0.0.9. The flaw resides in the formWriteFacMac function handling requests to /goform/WriteFacMac within the Web Management Interface. An attacker can manipulate the mac argument to inject arbitrary shell commands executed by the device. The exploit has been publicly released, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact

Authenticated remote attackers can execute arbitrary OS commands on affected Tenda F451 routers, leading to full device compromise and potential pivoting into internal networks.

Affected Products

• Tenda F451 firmware version 1.0.0.7
• Tenda F451 firmware version 1.0.0.9
• Web Management Interface component (/goform/WriteFacMac endpoint)

Discovery Timeline

• 2026-06-08 - CVE-2026-11556 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11556

Vulnerability Analysis

The vulnerability exists in the formWriteFacMac handler exposed through the /goform/WriteFacMac endpoint of the Tenda F451 Web Management Interface. The handler accepts a mac parameter that is passed to an underlying shell invocation without sufficient sanitization or neutralization of shell metacharacters. An attacker who can reach the management interface and supply a low-privileged credential can append additional shell commands to the mac value. The injected commands run with the privileges of the web server process, which typically operates as root on consumer router firmware. This grants full control over routing, DNS, firewall rules, and traffic interception capabilities.

Root Cause

The root cause is improper input neutralization in the formWriteFacMac function, classified as [CWE-77]. The function constructs a command string using attacker-controlled input from the mac HTTP parameter and dispatches it through a shell interpreter. Characters such as ;, |, &, and backticks are not stripped or escaped before execution.

Attack Vector

Exploitation requires network access to the router's Web Management Interface and a valid low-privilege session. The attacker submits a crafted HTTP request to /goform/WriteFacMac with a malicious mac parameter containing shell metacharacters followed by arbitrary commands. The device then executes the injected payload. A public proof-of-concept is referenced in the GitHub Vulnerability Report and the VulDB Vulnerability Details.

No verified code examples are available. See the GitHub Vulnerability Report for technical reproduction steps.

Detection Methods for CVE-2026-11556

Indicators of Compromise

• HTTP POST requests to /goform/WriteFacMac containing shell metacharacters such as ;, |, &, or backticks in the mac parameter.
• Unexpected outbound connections originating from the router to attacker-controlled infrastructure.
• New or modified configuration entries (DNS servers, firewall rules, administrative accounts) on the device.

Detection Strategies

• Inspect router HTTP access logs for requests targeting /goform/WriteFacMac and flag payloads containing non-hexadecimal characters in the mac field.
• Deploy network signatures on perimeter sensors to identify command injection patterns in traffic destined for Tenda management interfaces.
• Correlate router process anomalies, such as unexpected sh, wget, or tftp invocations, with inbound web management traffic.

Monitoring Recommendations

• Restrict and monitor any external exposure of router administrative interfaces, alerting on access from untrusted networks.
• Baseline normal management traffic volume and patterns, then alert on deviations targeting goform endpoints.
• Capture DNS resolution changes on client devices that may indicate router-level DNS hijacking following compromise.

How to Mitigate CVE-2026-11556

Immediate Actions Required

• Disable remote (WAN-side) administration on Tenda F451 devices and restrict LAN-side access to a trusted management subnet.
• Rotate all router administrative credentials and enforce strong, unique passwords.
• Audit device configuration for unauthorized DNS, firewall, or port-forwarding modifications.

Patch Information

No vendor advisory or fixed firmware release has been published in the referenced sources at the time of writing. Consult the Tenda Official Website for firmware updates and refer to the VulDB CVE Listing for tracking remediation status.

Workarounds

• Place the Web Management Interface behind a VPN or management VLAN that is not reachable from untrusted networks.
• Block inbound HTTP/HTTPS requests to /goform/WriteFacMac at an upstream firewall where feasible.
• Replace end-of-support or unpatched Tenda F451 units with vendor-supported hardware if a fix is not released.

# Example firewall rule to block external access to the router management interface
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP