Which versions of Tenda F456 are affected by CVE-2026-7055?

CVE-2026-7055 is a remote code execution vulnerability in Tenda F456 router firmware 1.0.0.5 that allows authenticated attackers to compromise routers through buffer overflow attacks on the httpd…

Is there a public PoC exploit available for CVE-2026-7055?

Yes, a public proof-of-concept exploit is available for CVE-2026-7055. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7055?

Within 24 hours: Identify all Tenda F456 routers on your network using firmware version 1.0.0.5 and document their current user access controls. Within 7 days: Verify whether default credentials remain active on any F456 device; if so, change all administrative passwords immediately and disable any unused user accounts. Within 30 days: Contact Tenda support to confirm patch availability and timeline; if no patch is released, implement network segmentation to restrict administrative access to F456 routers to trusted IP ranges only, and consider replacement with patched alternatives.

Tenda F456 CVE-2026-7055

Q: What is the CVSS score of CVE-2026-7055?

CVE-2026-7055 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25725 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-26 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 29, 2026 - 22:24 vuln.today

Public exploit code

Analysis Updated

Apr 26, 2026 - 22:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 26, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Apr 26, 2026 - 22:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 26, 2026 - 18:45 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 18:30 euvd

EUVD-2026-25725

Analysis Generated

Apr 26, 2026 - 18:30 vuln.today

CVE Published

Apr 26, 2026 - 18:00 nvd

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to overflow buffers in the httpd service via crafted menufacturer/Go parameters to the VirtualSer endpoint. Public exploit code exists on GitHub (Litengzheng/vuldb_new), enabling attackers with low-privilege credentials to achieve complete system compromise. While CVSS rates this 7.4 (High) with network attack vector and low complexity, the requirement for authentication (PR:L) moderates real-world risk compared to unauthenticated RCE - priority depends on whether default credentials are documented or credential stuffing is viable against target deployments.

Technical ContextAI

The vulnerability resides in the httpd daemon's fromVirtualSer function handling the /goform/VirtualSer endpoint, which processes virtual server configuration requests. CWE-120 (Buffer Copy Without Checking Size of Input) indicates classic unsafe string operations - likely strcpy() or sprintf() handling user-supplied menufacturer or Go parameter values without length validation. CPE cpe:2.3:a:tenda:f456 identifies this as application-level router firmware. Tenda routers commonly run embedded Linux with busybox httpd, where such CGI-like handlers parse form data directly into stack buffers. The CVSS vector shows complete confidentiality, integrity, and availability impact on the vulnerable component (VC:H/VI:H/VA:H) with no scope change (S:N), consistent with process-level code execution that doesn't escape the httpd context but grants full router control.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published security advisories or firmware updates addressing CVE-2026-7055 on their official site. Compensating controls: (1) Disable remote web management interface and restrict httpd access to LAN-only via router firewall rules (trade-off: lose remote admin capability, but eliminates AV:N attack surface); (2) Change default admin credentials immediately to strong unique passwords exceeding 16 characters (reduces PR:L risk but doesn't eliminate vulnerability); (3) Implement network segmentation isolating router management interface from untrusted networks via dedicated admin VLAN (operational complexity increases). Monitor VulDB advisory https://vuldb.com/vuln/359628 and Tenda support for future patches. If high-assurance environment, consider replacing device with vendor offering active security support.