CVE-2026-36785 Overview
CVE-2026-36785 is a stack overflow vulnerability in Tenda FH451 V1.0.0.9 routers manufactured by Shenzhen Tenda Technology Co., Ltd. The flaw resides in the fromDhcpListClient function, where the page parameter is processed without proper bounds checking. Remote unauthenticated attackers can send a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS). The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow and affects the router's web management interface.
Critical Impact
Unauthenticated network attackers can crash the router by sending a single crafted HTTP request, disrupting connectivity for all downstream users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda FH451
- Firmware version V1.0.0.9
- Web management interface handling DHCP client list requests
Discovery Timeline
- 2026-06-05 - CVE-2026-36785 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-36785
Vulnerability Analysis
The vulnerability exists in the fromDhcpListClient function within the Tenda FH451 firmware. This function handles HTTP requests that retrieve the DHCP client list from the router's web administration interface. The page parameter, supplied in the HTTP request, is copied into a fixed-size stack buffer without validating its length.
When an attacker submits an oversized value in the page parameter, the copy operation writes past the end of the stack buffer. The overflow corrupts adjacent stack memory, including saved return addresses and local variables. The corruption causes the HTTP daemon to crash, terminating the router's management service and degrading overall device stability.
The issue is reachable over the network without authentication, since the affected handler is accessible on the router's HTTP interface. The current public analysis describes the impact as a denial of service. Memory corruption of this type can in some cases enable code execution on MIPS or ARM embedded targets, but no public exploit demonstrating that outcome has been disclosed for this CVE.
Root Cause
The root cause is the absence of length validation on attacker-controlled input before a stack buffer copy. The fromDhcpListClient handler trusts the size of the page HTTP parameter and performs an unchecked string copy into a fixed-size local buffer, violating safe memory handling practices for embedded HTTP servers.
Attack Vector
An attacker sends a single HTTP request to the router's web management interface with an overly long page parameter directed at the DHCP client list endpoint. No credentials, user interaction, or prior access are required. The malformed request triggers the overflow and crashes the service. Researchers have published proof-of-concept material in the SemVulLLM GitHub repository.
Detection Methods for CVE-2026-36785
Indicators of Compromise
- Unexpected reboots or crashes of the Tenda FH451 router, particularly its web management daemon
- HTTP requests to DHCP client list endpoints containing abnormally long page parameter values
- Repeated HTTP POST or GET requests from a single source targeting the router's administrative interface
- Loss of LAN connectivity coinciding with inbound traffic to the router's HTTP management port
Detection Strategies
- Inspect HTTP traffic destined for router management interfaces and alert on page parameter values exceeding expected lengths
- Deploy network intrusion detection signatures that flag oversized query string parameters in requests to embedded device web servers
- Correlate router availability monitoring data with inbound HTTP traffic patterns to identify DoS attempts
Monitoring Recommendations
- Enable uptime and availability monitoring on the Tenda FH451 and alert on unplanned restarts
- Log all administrative HTTP access to the router and forward logs to a centralized SIEM for analysis
- Restrict the source IP ranges permitted to reach the router's web management interface and monitor for policy violations
How to Mitigate CVE-2026-36785
Immediate Actions Required
- Disable remote (WAN-side) access to the Tenda FH451 web management interface immediately
- Restrict LAN-side access to the management UI to a small set of trusted administrative hosts
- Place vulnerable devices behind a network segmentation boundary that filters untrusted HTTP traffic
- Monitor vendor channels at Shenzhen Tenda Technology for a firmware update addressing CVE-2026-36785
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-36785. Administrators should track the vendor's support site for firmware releases beyond V1.0.0.9 that remediate the stack overflow in fromDhcpListClient. Until a patch is available, compensating controls are required.
Workarounds
- Block external access to TCP port 80 and 443 on the WAN interface of the router using upstream firewall rules
- Use an ACL on the router to allow management interface access only from designated administrator IP addresses
- Replace affected Tenda FH451 devices with supported hardware if no patch is released within an acceptable timeframe
- Rate-limit HTTP requests to the router's management interface to slow automated DoS attempts
# Example upstream firewall rule to block WAN access to the Tenda management UI
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP
# Allow management only from a trusted admin subnet on the LAN side
iptables -A FORWARD -p tcp -s 10.0.0.0/24 -d <router_lan_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_lan_ip> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
