CVE-2026-11556
Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
CVSS Score
8.8
EPSS Score
0.3%
EPSS Percentile
54th
A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
| CWE | CWE-78 CWE-77 |
| Vendor | tenda |
| Product | f451 |
| Published | Jun 8, 2026 |
| Last Updated | Jun 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for tenda f451
Be the first to know when new high vulnerabilities affecting tenda f451 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Tenda / F451
1.0.0.7 1.0.0.9
References
vuldb.com: https://vuldb.com/vuln/369166 vuldb.com: https://vuldb.com/vuln/369166/cti vuldb.com: https://vuldb.com/cve/CVE-2026-11556 vuldb.com: https://vuldb.com/submit/836476 github.com: https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formWriteFacMac2/formWriteFacMac.md tenda.com.cn: https://www.tenda.com.cn/
Credits
🔍 hacker128 (VulDB User)