Which versions of Tenda F456 are affected by CVE-2026-7030?

Tenda F456 routers running firmware 1.0.0.5 are vulnerable to remote code execution via authenticated buffer overflow attacks on the RouteStatic configuration handler, with publicly available exploit…

Is there a public PoC exploit available for CVE-2026-7030?

Yes, a public proof-of-concept exploit is available for CVE-2026-7030. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7030?

Within 24 hours: Inventory all Tenda F456 devices in production and identify firmware version 1.0.0.5 deployments; isolate affected devices from untrusted networks if possible. Within 7 days: Implement network-level access controls restricting /goform/RouteStatic endpoint access to trusted administration sources only; disable remote management features if not operationally required; monitor for suspicious authentication attempts and RouteStatic requests. Within 30 days: Monitor Tenda security advisories for vendor-released firmware patches; develop upgrade testing plan; contact Tenda support for patch availability timeline and interim guidance; evaluate replacement with patched firmware version when available.

Tenda F456 CVE-2026-7030

Q: What is the CVSS score of CVE-2026-7030?

CVE-2026-7030 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25705 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-26 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:03 vuln.today

Public exploit code

Analysis Updated

Apr 26, 2026 - 10:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 26, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Apr 26, 2026 - 10:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 26, 2026 - 10:15 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 09:45 euvd

EUVD-2026-25705

Analysis Generated

Apr 26, 2026 - 09:45 vuln.today

CVE Published

Apr 26, 2026 - 09:15 nvd

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Remote code execution in Tenda F456 router firmware version 1.0.0.5 allows authenticated attackers to crash the device or execute arbitrary code via buffer overflow in the RouteStatic configuration handler. The vulnerability targets the 'page' parameter in /goform/RouteStatic endpoint and requires only low-privilege authentication (CVSS PR:L). A publicly available proof-of-concept exploit exists on GitHub, significantly lowering the technical barrier for exploitation. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low attack complexity (AC:L) and network-based attack vector (AV:N).

Technical ContextAI

This vulnerability affects the fromRouteStatic function in Tenda F456 router firmware, specifically in the /goform/RouteStatic endpoint responsible for static route configuration. The root cause is a classic buffer overflow (CWE-120) triggered by improper validation of the 'page' argument. Buffer overflows occur when data written to a buffer exceeds its allocated memory boundary, potentially overwriting adjacent memory regions including return addresses and function pointers. In embedded router firmware written in C/C++ without modern memory protections, such vulnerabilities commonly enable control-flow hijacking. The CPE string (cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*) identifies this as affecting the Tenda F456 product line, though the wildcard version suggests potential impact across multiple firmware versions beyond the confirmed 1.0.0.5.

RemediationAI

Check the Tenda official website (https://www.tenda.com.cn/) for firmware updates addressing CVE-2026-7030 and upgrade to the latest available version if a patched release exists - no specific fixed version number is confirmed in available data at time of analysis. Until patching is possible, implement the following compensating controls with noted trade-offs: (1) Disable remote management access to the router's web interface, restricting administration to local LAN only - this prevents network-based exploitation but requires physical network access for configuration changes; (2) Change default administrative credentials to strong unique passwords (minimum 16 characters, mixed case, numbers, symbols) - reduces authentication bypass risk but does not eliminate the underlying buffer overflow; (3) Segment the router management interface on an isolated VLAN accessible only to trusted administrator workstations - limits lateral movement but adds network complexity; (4) Deploy network-based IDS/IPS signatures to detect exploitation attempts targeting /goform/RouteStatic with abnormal 'page' parameter lengths - provides detection but may generate false positives and does not prevent exploitation. For organizations with multiple affected devices, prioritize replacement with alternative router models that receive active security support, as Tenda's patch history for legacy devices may be limited.