CVE-2026-11556: Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection

Synopsis

An OS command injection flaw exists in the Tenda F451 router's web management interface, specifically in the formWriteFacMac function that handles requests to /goform/WriteFacMac. An attacker with a low-privilege account can send a crafted 'mac' argument to this endpoint over the network, injecting arbitrary operating system commands without any victim interaction. Successful exploitation gives the attacker full control of the device, including the ability to read, modify, or destroy data and disrupt device operation. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web management interface over the network; the vulnerable endpoint is remotely accessible.

• AuthenticationRequired

  A low-privilege account on the web management interface is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends the malicious request directly to the endpoint.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• The attacker executes arbitrary OS commands on the Tenda F451 device with the privileges of the web server process.
• Credentials, configuration data, and any secrets stored on the device are exposed and readable by the attacker.
• The attacker can modify device configuration, firmware settings, or routing rules, altering device behavior persistently.
• The attacker can crash or restart the device, causing a loss of network connectivity for any clients depending on it.