CVE-2026-36785: Tenda FH451 Stack Overflow DoS Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-36785 is a stack-based buffer overflow (CWE-121) in Tenda FH451 V1.0.0.9's fromDhcpListClient function. The vulnerability is triggered by unsanitized user input in the 'page' HTTP parameter, which overflows the stack and causes memory corruption. The attack vector is network-based with no authentication required, low attack complexity, and no user interaction needed. The result is denial of service through application crash or system hang.

Business impact

Routers affected by this vulnerability become unstable and unreliable, disrupting internet access for end users and dependent services. In enterprise environments, compromised Tenda FH451 devices could cause widespread connectivity outages, impacting productivity and customer-facing systems. Organizations cannot guarantee network uptime until remediation is applied. The vulnerability does not enable data theft or integrity compromise, limiting impact to availability.

Affected systems

Tenda FH451 running firmware version 1.0.0.9 is confirmed vulnerable. Organizations should verify whether this router model is deployed in their infrastructure, particularly in branch offices, remote sites, or smaller deployments where Tenda equipment is common. The vendor product information was not provided in the advisory; check Tenda's official documentation to determine whether other FH451 firmware versions or related models are similarly affected.

Exploitability

This vulnerability presents a moderate exploitation barrier despite its network accessibility. An attacker requires the ability to craft a specific HTTP request targeting the DHCP client listing function—not a trivial task without reverse-engineering or public proof-of-concept code. However, no authentication is required and the attack can be launched remotely. The lack of CISA KEV designation suggests either limited active exploitation observed in the wild or insufficient public awareness. Nonetheless, the low technical barrier once exploit details emerge warrants proactive patching.

Remediation

Contact Tenda support to obtain a patched firmware version for the FH451 router. Verify against Tenda's security advisory for the exact version number and upgrade path. If a patch is unavailable, consider isolating affected routers from untrusted networks or replacing them with devices from vendors maintaining active security support. Document firmware versions in your inventory to prevent re-deployment of vulnerable units.

Patch guidance

Check Tenda's official support portal and security advisories for a fixed firmware release addressing CVE-2026-36785. Follow Tenda's recommended upgrade procedure, which typically involves downloading the firmware image, backing up configuration, and performing a factory reset if instructed. Test the upgrade on a non-critical device first. Verify the new firmware version is confirmed as patched before rolling out across your deployment. If the vendor has not released a patch, document the business risk and implement compensating controls.

Detection guidance

Monitor for HTTP requests to the fromDhcpListClient function with abnormally long or malformed 'page' parameters. Network intrusion detection systems (IDS) should flag attempts to exploit buffer overflows on Tenda FH451 devices. Log HTTP requests to the router's web interface and alert on patterns suggesting exploitation. Consider running port scans to identify FH451 routers in your environment and verify their firmware versions. Baseline normal DHCP client listing queries and flag deviations.

Why prioritize this

This vulnerability ranks as high-priority due to its CVSS 7.5 score, network accessibility, and lack of authentication barriers. While not yet listed on CISA's KEV catalog, the ease of triggering a denial-of-service condition makes it attractive to attackers seeking to disrupt services. Organizations with Tenda FH451 routers should prioritize patching or replacement within their normal maintenance windows. The impact is limited to availability, not confidentiality or integrity, which tempers urgency slightly compared to remote code execution flaws.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, resulting in high availability impact. The attack complexity is low, and the scope is unchanged. The absence of confidentiality or integrity impact prevents a critical rating. The score aligns with a remotely exploitable denial-of-service flaw in network infrastructure equipment where rapid availability restoration is essential.

Frequently asked questions