CVE-2026-36786 Overview
CVE-2026-36786 is a stack-based buffer overflow [CWE-121] in the Tenda FH451 router running firmware version V1.0.0.9. The vulnerability resides in the fromDhcpListClient function, where the list1 parameter is processed without sufficient bounds checking. A remote unauthenticated attacker can send a crafted HTTP request to overflow the stack buffer and crash the device. Successful exploitation results in a Denial of Service (DoS) condition on the affected router.
Critical Impact
Unauthenticated network attackers can trigger a stack overflow through a single crafted HTTP request, causing the router to become unresponsive and disrupting all network traffic relying on the device.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda FH451
- Firmware version V1.0.0.9
- Web management interface exposing the fromDhcpListClient handler
Discovery Timeline
- 2026-06-08 - CVE-2026-36786 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-36786
Vulnerability Analysis
The flaw is a classic stack-based buffer overflow in the router's HTTP management service. The fromDhcpListClient function handles requests related to the DHCP client list feature. When processing the list1 parameter from an incoming HTTP request, the function copies user-controlled data into a fixed-size stack buffer without validating the input length.
An attacker only needs network reachability to the device's web interface. No authentication or user interaction is required, which makes the vulnerability trivially exploitable on exposed devices. The current public proof of concept demonstrates a crash, classifying the impact as a Denial of Service. Stack overflows of this class can sometimes be extended to code execution depending on stack protections present in the firmware.
Root Cause
The root cause is missing length validation when the list1 HTTP parameter is copied into a stack-allocated buffer inside fromDhcpListClient. The firmware lacks proper boundary checks before invoking unsafe string-handling routines, allowing adjacent stack memory and the saved return address to be overwritten.
Attack Vector
The attack vector is purely network-based. An attacker sends a single HTTP request to the router's web management interface containing an oversized list1 parameter targeting the fromDhcpListClient endpoint. The oversized value overwrites the stack frame, corrupting saved registers and the return pointer. The device then crashes or enters an unrecoverable state, interrupting all routed traffic.
A public proof of concept is hosted at the GitHub Proof of Concept Repository. Refer to the repository for technical details on the exact request structure.
Detection Methods for CVE-2026-36786
Indicators of Compromise
- Unexpected reboots or unresponsiveness of the Tenda FH451 device following inbound HTTP traffic to the management interface.
- HTTP POST requests targeting the fromDhcpListClient endpoint containing abnormally long list1 parameter values.
- Loss of routing or DHCP services without a corresponding administrator action in device logs.
Detection Strategies
- Inspect HTTP traffic destined for the router's management interface for list1 parameter values exceeding expected lengths (typically a few hundred bytes).
- Deploy network IDS signatures that flag requests to fromDhcpListClient with oversized parameters.
- Correlate router availability monitoring with inbound HTTP request logs to identify crash-inducing traffic.
Monitoring Recommendations
- Enable ICMP and SNMP availability checks against the FH451 to detect crash conditions within seconds.
- Forward perimeter firewall and IPS logs to a centralized log platform and alert on repeated requests to /goform/ style endpoints from external sources.
- Track EPSS scoring for CVE-2026-36786 over time to gauge changes in exploitation likelihood.
How to Mitigate CVE-2026-36786
Immediate Actions Required
- Restrict access to the router's web management interface to trusted internal management VLANs only.
- Disable remote (WAN-side) administration on all Tenda FH451 devices.
- Block inbound HTTP and HTTPS traffic to the device from untrusted networks at the upstream firewall.
- Inventory all Tenda FH451 devices running firmware V1.0.0.9 across the environment.
Patch Information
At the time of publication, no vendor patch from Shenzhen Tenda Technology Co., Ltd has been referenced in the NVD entry for CVE-2026-36786. Administrators should monitor the Tenda support portal for firmware updates addressing the fromDhcpListClient stack overflow and apply them as soon as they become available.
Workarounds
- Place the FH451 behind a network segment that enforces source-IP restrictions on management traffic.
- Use an upstream reverse proxy or WAF to drop HTTP requests targeting fromDhcpListClient with list1 parameter values longer than the expected maximum.
- Where feasible, replace the FH451 with a supported device until a firmware fix is released.
# Example iptables rule to restrict management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
