CVE-2026-6120 — AI Deep Analysis Summary

- **CVE-2026-6120**: Stack-based overflow in `httpd` of **Tenda F451** 🚨 - Happens in `DhcpListClient` → `fromDhcpListClient` - **Consequence**: Full control risk 💥 - Remote code exec possible - Device compro…

- **Root Cause**: Stack-based buffer overflow ⚠️ - Likely **CWE-121**: Stack buffer overflow - Triggered by crafted input in DHCP client handling 🔍

- **Affected Product**: **Tenda F451** router 📶 - Component: `httpd` service - Firmware: `F451_kfw_V1.0.0.7_cn_svn7958 V1.0.0.7` 🧩 - Others unconfirmed ❓

- **Hackers can**: - Gain **high impact** 🚨 - **Privilege**: Auth user (PR:L) → full control - Access, modify, delete **data** 💾 - Execute arbitrary code 🖥️

- **Exploitation threshold**: LOW ✅ - **Attack Vector**: Network (AV:N) - **Attack Complexity**: Low (AC:L) - **Privileges Required**: Low (PR:L) - **No User Interaction** (UI:N) 🎯

- **Public Exploit**: YES 🚨 - Ref: `https://github.com/Jimi-Lab/cve/issues/11` 🔗 - Tagged: `exploit`, `issue-tracking` - No PoC listed in `pocs` field but GitHub shows activity 🧪

- **Self-check**: - Check firmware = `V1.0.0.7` 🔍 - Monitor `httpd` crashes/log anomalies 🧠 - Scan w/ signature from `VDB-356983/cti` 🛡️ - Look for DHCP list parsing issues 📋

- **Official Fix**: NOT mentioned 🚫 - No patch info in refs/tags - Advisory exists, but no fix link 📭 - Status: **Unpatched** ❌

- **Workaround if no patch**: - Restrict access to `httpd` port 🚷 - Disable unused DHCP features 🛑 - Apply firewall rules at network edge 🧱 - Monitor & alert on abnormal DHCP requests 🔔

- **Urgency**: HIGH 🔥 - CVSS: `9.0` range (H/H/H) 💥 - Public exploit + remote + no patch = 🚨 - **Priority**: Patch ASAP or isolate device 🛡️⏰