CVE-2026-11556

8.8 HIGH

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9

Published: 2026-06-08 · Last updated: 2026-06-09

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-77, CWE-78

Description

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-11556
[Other]https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formWriteFacMac2/formWriteFacMac.md
[Other]https://vuldb.com/cve/CVE-2026-11556
[Other]https://vuldb.com/submit/836476
[Other]https://vuldb.com/vuln/369166
[Other]https://vuldb.com/vuln/369166/cti
[Other]https://www.tenda.com.cn/

Related CVEs

Same CWE

CVE-2026-24719 — A command injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2026-22893 — A command injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2025-66279 — A command injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2025-66273 — A command injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2026-49959 — Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitr... (8.8 HIGH)