Which versions of Tenda F456 are affected by CVE-2026-7019?

CVE-2026-7019 is a high-severity remote code execution vulnerability in Tenda F456 routers (firmware 1.0.0.5) that allows authenticated users with low-privilege access to crash devices or execute…

How to fix or mitigate CVE-2026-7019?

Within 24 hours: Identify all Tenda F456 devices running firmware 1.0.0.5 in your network inventory and disable remote management interfaces if not operationally critical. Within 7 days: Check Tenda's security advisories for firmware updates to version 1.0.0.6 or later; contact Tenda support directly if patches remain unavailable. Within 30 days: Implement network segmentation to restrict management interface access to authorized administrators only, require multi-factor authentication for any remote management, and establish continuous firmware update monitoring for affected devices.

Tenda F456 CVE-2026-7019

Q: What is the CVSS score of CVE-2026-7019?

CVE-2026-7019 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25694 HIGH

Buffer Overflow (CWE-119)

2026-04-26 cna@vuldb.com

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 26, 2026 - 05:30 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 05:22 euvd

EUVD-2026-25694

Analysis Generated

Apr 26, 2026 - 05:22 vuln.today

CVE Published

Apr 26, 2026 - 05:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to crash the device or execute arbitrary code via buffer overflow in the fromP2pListFilter function. Exploitation requires low-privilege authentication (PR:L) and is network-accessible (AV:N) with low attack complexity (AC:L). Publicly available exploit code exists (CVSS E:P), significantly lowering the barrier to exploitation. EPSS data not provided, but public POC availability and router attack surface suggest moderate real-world risk for exposed management interfaces.

Technical ContextAI

This vulnerability affects the fromP2pListFilter function in the /goform/P2pListFilter endpoint of Tenda F456 router firmware version 1.0.0.5. The root cause is CWE-119 (Improper Restriction on Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition. The vulnerability is triggered by manipulating the 'menufacturer' or 'Go' parameters (note the typo 'menufacturer' suggests poor input validation). Buffer overflows in router web management interfaces typically occur when string manipulation functions do not validate input length before copying data to fixed-size buffers. Successful exploitation can overwrite adjacent memory regions including return addresses or function pointers, enabling control-flow hijacking. The /goform/ path is common in Tenda router web management interfaces, which often run with elevated privileges on embedded Linux systems.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published a security advisory addressing CVE-2026-7019 based on available references. Organizations using Tenda F456 routers should implement compensating controls immediately: Disable remote management access to the web interface from untrusted networks by blocking external access to TCP ports 80/443 on the WAN interface (trade-off: remote administration unavailable, requires local or VPN access for management). Change default administrative credentials to strong, unique passwords to raise the authentication barrier (trade-off: does not eliminate vulnerability but prevents exploitation via default/weak credentials). Restrict management interface access to specific trusted IP addresses using firewall rules if remote management is required (trade-off: complex to maintain for dynamic IP environments). Deploy the router behind a separate firewall appliance that can inspect and filter malicious requests to /goform/ endpoints (trade-off: additional cost and complexity). Monitor vendor security advisories at https://www.tenda.com.cn/ for official patch releases. Consider replacing the device with alternative router models from vendors with active security support if patch is not released within reasonable timeframe. For home users, the most practical mitigation is disabling WAN-side management access and ensuring strong admin passwords.