Which versions of Tenda F456 are affected by CVE-2026-7029?

Tenda F456 router firmware version 1.0.0.5 contains a buffer overflow vulnerability in the NAT configuration endpoint that allows authenticated attackers to execute arbitrary code or disable the…

Is there a public PoC exploit available for CVE-2026-7029?

Yes, a public proof-of-concept exploit is available for CVE-2026-7029. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7029?

Within 24 hours: Inventory all Tenda F456 devices running firmware version 1.0.0.5 and identify network criticality and exposure. Within 7 days: Restrict network access to the /goform/addressNat endpoint via firewall rules; implement device-level authentication hardening and credential rotation for router administrative accounts. Within 30 days: Contact Tenda support for patched firmware availability; evaluate replacement with vendor-supported router models that receive active security updates; implement network segmentation to isolate router management interfaces.

Tenda F456 CVE-2026-7029

Q: What is the CVSS score of CVE-2026-7029?

CVE-2026-7029 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25704 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-26 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:03 vuln.today

Public exploit code

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 26, 2026 - 09:45 vuln.today

CVSS changed

Apr 26, 2026 - 09:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 26, 2026 - 09:15 euvd

EUVD-2026-25704

Analysis Generated

Apr 26, 2026 - 09:15 vuln.today

CVE Published

Apr 26, 2026 - 09:00 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /goform/addressNat. Executing a manipulation of the argument menufacturer/Go can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Buffer overflow in Tenda F456 router firmware version 1.0.0.5 allows authenticated remote attackers to execute arbitrary code or crash the device by sending malformed HTTP requests to the /goform/addressNat endpoint. The vulnerability exists in the fromaddressNat function and is actively exploitable with publicly available proof-of-concept code. CVSS 7.4 with low attack complexity indicates straightforward exploitation once authenticated, while EPSS data (if available) would contextualize real-world exploitation likelihood beyond the confirmed POC availability.

Technical ContextAI

This vulnerability affects the Tenda F456 router (CPE: cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*) firmware version 1.0.0.5 in its web management interface. The flaw is a classic stack-based buffer overflow (CWE-120) occurring in the fromaddressNat function within the /goform/addressNat endpoint handler. When processing HTTP POST requests to configure Network Address Translation (NAT) settings, the function fails to properly validate the length of user-supplied parameters 'menufacturer' and 'Go' before copying them into fixed-size buffers. This enables memory corruption beyond allocated boundaries, typical of embedded device firmware written in C/C++ without modern memory safety protections. The /goform/ path pattern is characteristic of GoAhead web servers commonly deployed in consumer networking equipment.

RemediationAI

No vendor-released patch or firmware update has been identified at the time of analysis - Tenda has not published a security advisory addressing CVE-2026-7029 in the provided references. As primary mitigation, immediately restrict access to the router's web management interface: (1) Disable remote/WAN management access entirely in router settings (typically under Administration or Remote Management) - this eliminates network attack vector for internet-facing devices with performance trade-off of requiring local network access for configuration, (2) Change default administrator credentials to strong unique passwords (16+ characters) to raise the authentication barrier (PR:L requirement), (3) Bind management interface to LAN-only IP addresses and block port 80/443 from WAN in firewall rules if WAN management cannot be disabled. For enterprise environments, place affected devices behind network segmentation with strict firewall policies allowing only necessary management traffic from designated admin workstations. Monitor access logs at /goform/addressNat endpoint for repeated requests with abnormal parameter lengths as potential exploitation attempts. Consider replacing device with actively supported hardware if Tenda does not release security updates, as embedded devices without vendor support pose ongoing risk. VulDB reference: https://vuldb.com/vuln/359609