CVE-2026-11557: Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Tenda F451 router's web management interface, specifically in the fromNatlimit function at /goform/Natlimit. An attacker with a low-privilege account can reach this endpoint over the network and trigger the overflow by manipulating the page argument, requiring no interaction from any other user. Successful exploitation gives the attacker full read access to confidential data, the ability to modify system state, and the ability to crash or destabilize the device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network through the web management interface, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The attack requires a low-privilege account on the web management interface; any standard user credential is sufficient.

• Victim interactionNot required

  The attacker can trigger the overflow without any action from another user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• The attacker reads confidential data stored or processed by the device, including any credentials, session tokens, or configuration secrets accessible in router memory.
• The attacker modifies device configuration or persisted state, enabling traffic redirection, NAT rule tampering, or backdoor insertion.
• The attacker crashes the affected web management process or the device itself, disrupting routing and network availability for all hosts behind the router.