High severity · published Jun 8, 2026
CVE-2026-11556
Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F4
F451 · Tenda
1.0.0.7; 1.0.0.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11556
github.com
https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formWriteFacMac2/formWriteFacMac.md
vuldb.com
https://vuldb.com/cve/CVE-2026-11556
vuldb.com
https://vuldb.com/submit/836476
vuldb.com
https://vuldb.com/vuln/369166
vuldb.com
https://vuldb.com/vuln/369166/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from F451
8.8
CVE-2026-11557
Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow
8.8
CVE-2026-6632
Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow
8.8
CVE-2026-6631
Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow
8.8
CVE-2026-6630
Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow
8.8
CVE-2026-6137
Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow