Which versions of Tenda F456 are affected by CVE-2026-7054?

CVE-2026-7054 affects Tenda F456 routers (firmware 1.0.0.5), enabling authenticated attackers to execute arbitrary code through PPTP configuration parameters.

Is there a public PoC exploit available for CVE-2026-7054?

Yes, a public proof-of-concept exploit is available for CVE-2026-7054. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7054?

Within 24 hours: Inventory all Tenda F456 routers in production, verify firmware version, and document internet exposure. Within 7 days: Disable PPTP functionality if not operationally required; enforce strong unique administrative credentials; restrict web interface access to trusted networks only via firewall rules. Within 30 days: Monitor Tenda security advisories for patched firmware releases; evaluate replacement with devices from vendors providing active security support; implement network segmentation to isolate router management interfaces.

Tenda F456 CVE-2026-7054

Q: What is the CVSS score of CVE-2026-7054?

CVE-2026-7054 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25724 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-26 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 29, 2026 - 22:28 vuln.today

Public exploit code

Analysis Updated

Apr 26, 2026 - 22:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 26, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Apr 26, 2026 - 22:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 26, 2026 - 18:01 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 17:30 euvd

EUVD-2026-25724

Analysis Generated

Apr 26, 2026 - 17:30 vuln.today

CVE Published

Apr 26, 2026 - 16:45 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects the function fromPptpUserAdd of the file /goform/PPTPDClient of the component httpd. Executing a manipulation of the argument opttype/usernamewith can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Buffer overflow in Tenda F456 router firmware 1.0.0.5 allows authenticated remote attackers to execute arbitrary code via malformed PPTP client parameters. The vulnerability resides in the fromPptpUserAdd function of the httpd web server component, specifically through manipulation of the opttype/usernamewith arguments. Public exploit code is available on GitHub, significantly lowering the barrier for exploitation against internet-exposed Tenda F456 devices with default or weak administrative credentials.

Technical ContextAI

The vulnerability affects the httpd web server daemon in Tenda F456 firmware version 1.0.0.5, specifically within the PPTP client configuration handler at /goform/PPTPDClient. The fromPptpUserAdd function performs inadequate bounds checking on user-supplied input parameters (opttype/usernamewith), resulting in a classic stack or heap buffer overflow (CWE-120). PPTP (Point-to-Point Tunneling Protocol) client configuration is a common feature in consumer routers for VPN connectivity. The httpd component handles administrative web interface requests, making this a server-side vulnerability in the router's management plane. Buffer overflows in embedded device web servers are particularly dangerous because httpd processes typically run with elevated privileges and may lack modern exploit mitigations like ASLR or DEP commonly found in desktop operating systems.

RemediationAI

No vendor-released patch has been identified at time of analysis. Check Tenda's official website at https://www.tenda.com.cn/ for firmware updates beyond version 1.0.0.5. Until a patch is available, implement these compensating controls: (1) Disable remote administration access to the router's web interface - restrict management to LAN-only access, trading remote convenience for security; (2) Change default administrative credentials to strong, unique passwords (minimum 16 characters, alphanumeric+symbols) to raise the authentication barrier; (3) If PPTP client functionality is not required, disable the PPTP client feature entirely through the router interface to eliminate the attack surface; (4) Deploy the F456 behind a firewall that blocks external access to the management interface (typically TCP ports 80/443/8080), though this may complicate legitimate remote management. Note that disabling remote admin is the most effective mitigation but prevents remote troubleshooting. Monitor VulDB advisory at https://vuldb.com/vuln/359627 and the public exploit repository at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_125/README.md for updates.