CVE-2026-2911: Tenda FH451 Buffer Overflow Vulnerability

CVE-2026-2911 Overview

CVE-2026-2911 is a buffer overflow vulnerability affecting Tenda FH451 routers running firmware version 1.0.0.9 and earlier. The flaw resides in the /goform/GstDhcpSetSer endpoint, where unspecified input handling fails to enforce proper memory boundaries [CWE-119]. Attackers can trigger the overflow remotely over the network with low privileges and no user interaction. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed devices.

Critical Impact
Successful exploitation can compromise confidentiality, integrity, and availability of the affected router, potentially enabling arbitrary code execution or denial of service on the device.

Affected Products

Tenda FH451 router (hardware)
Tenda FH451 firmware versions up to and including 1.0.0.9
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2026-02-22 - CVE-2026-2911 published to NVD
2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2911

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-119] in the HTTP handler servicing the /goform/GstDhcpSetSer endpoint of the Tenda FH451 router. This endpoint manages DHCP server configuration parameters submitted through the web management interface. The handler processes attacker-controlled input without enforcing adequate bounds checking on the destination buffer.

Because the request can be sent remotely and requires only low privileges, an attacker with access to the management interface can craft an HTTP request that overflows an internal buffer. The overflow corrupts adjacent memory in the router process and can lead to denial of service or, depending on the memory layout, code execution on the embedded MIPS or ARM platform typical of Tenda devices.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer in the GstDhcpSetSer form handler. Input parameters are copied into fixed-size stack or heap buffers without length validation, allowing an oversized value to overwrite adjacent memory, including saved return addresses or function pointers.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP POST request to /goform/GstDhcpSetSer containing oversized parameter values. Because attack complexity is low and the exploit has been publicly disclosed, automated scanning and exploitation against internet-exposed FH451 devices is feasible.

The vulnerability manifests in the DHCP configuration form handler. See Ricky's Vulnerability Report and the VulDB entry for technical details on the affected parameter and request structure.

Detection Methods for CVE-2026-2911

Indicators of Compromise

HTTP POST requests to /goform/GstDhcpSetSer containing abnormally long parameter values
Unexpected reboots or crashes of the Tenda FH451 device coinciding with inbound web traffic
Outbound connections from the router to unfamiliar hosts following web management activity
Changes to DHCP server settings that were not initiated by an administrator

Detection Strategies

Inspect web server and router logs for POST requests to /goform/GstDhcpSetSer with payloads exceeding expected field lengths
Deploy network IDS signatures that flag oversized parameter values in HTTP requests targeting Tenda goform endpoints
Monitor for repeated 5xx responses or connection resets from the router management interface, which can indicate crash conditions

Monitoring Recommendations

Restrict and audit access to the router web management interface from untrusted network segments
Forward router syslog data to a centralized logging platform and alert on crash events or watchdog reboots
Track firmware version inventory for Tenda devices and flag any unit running version 1.0.0.9 or earlier

How to Mitigate CVE-2026-2911

Immediate Actions Required

Block external access to the FH451 web management interface at the perimeter firewall
Limit management access to a dedicated administrative VLAN or trusted source IP addresses only
Change default administrative credentials and enforce strong, unique passwords on the device
Audit DHCP server configuration on affected routers for unauthorized modifications

Patch Information

At the time of publication, no vendor security advisory or patched firmware release has been linked in the NVD entry. Refer to the Tenda official website for firmware updates and contact vendor support for guidance specific to the FH451 platform. If a patched build is not yet available, treat the device as vulnerable and apply compensating controls.

Workarounds

Disable remote (WAN-side) administration on the FH451 to prevent internet-based exploitation
Place the router management interface behind a VPN so the goform endpoints are not reachable from untrusted networks
Replace end-of-support or unpatched FH451 units with a currently supported model if the vendor does not release a fix

bash

# Configuration example: restrict management access using an upstream firewall
# Allow only a trusted admin subnet to reach the router web UI
iptables -A FORWARD -s 192.0.2.0/24 -d <router-ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router-ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router-ip> -p tcp --dport 443 -j DROP