Which versions of Tenda F456 are affected by CVE-2026-7078?

Tenda F456 routers running firmware version 1.0.0.5 contain a buffer overflow vulnerability in the web management interface that allows authenticated users to execute arbitrary code and fully…

Is there a public PoC exploit available for CVE-2026-7078?

Yes, a public proof-of-concept exploit is available for CVE-2026-7078. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7078?

Within 24 hours: Identify all Tenda F456 routers in your environment using inventory or network scanning and document firmware versions. Within 7 days: Check Tenda's official website for any available firmware updates beyond version 1.0.0.5 and test in a non-production environment; if no patch is available, implement the compensating controls listed below. Within 30 days: Evaluate replacing affected Tenda F456 devices with alternative routers from vendors with active patch management programs, or implement network segmentation to restrict access to the management interface.

Tenda F456 CVE-2026-7078

Q: What is the CVSS score of CVE-2026-7078?

CVE-2026-7078 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25761 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-27 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:38 vuln.today

Public exploit code

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 03:30 vuln.today

CVSS changed

Apr 27, 2026 - 03:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 03:00 euvd

EUVD-2026-25761

Analysis Generated

Apr 27, 2026 - 03:00 vuln.today

CVE Published

Apr 27, 2026 - 02:15 nvd

HIGH 7.4

DescriptionCVE.org

A security flaw has been discovered in Tenda F456 1.0.0.5. The impacted element is the function fromSetIpBind of the file /goform/SetIpBind of the component httpd. The manipulation of the argument page results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Buffer overflow in Tenda F456 router version 1.0.0.5 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSetIpBind function of the httpd daemon's /goform/SetIpBind endpoint, exploitable via malformed 'page' parameter input. Public exploit code exists on GitHub (Litengzheng/vuldb_new), elevating real-world risk despite requiring low-privilege authentication (CVSS 7.4, EPSS data not provided, not in CISA KEV at time of analysis).

Technical ContextAI

This vulnerability affects the httpd web server component of Tenda F456 routers (CPE: cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*), specifically firmware version 1.0.0.5. The flaw is a classic buffer overflow (CWE-120) in the fromSetIpBind function handling the /goform/SetIpBind endpoint, which typically manages IP-MAC binding configuration in consumer routers. The 'page' parameter lacks proper bounds checking, allowing authenticated users to overflow stack or heap buffers by sending oversized input. The CVSS 4.0 vector indicates network-accessible exploitation with low complexity and low privilege requirements, resulting in high impact across confidentiality, integrity, and availability within the vulnerable component scope. The httpd daemon likely runs with elevated privileges on the router's embedded Linux system, making buffer overflows particularly dangerous for remote code execution scenarios.

RemediationAI

No vendor-released patch or updated firmware version identified at time of analysis - Tenda has not published security advisories addressing CVE-2026-7078 per available references. Until official patches are available, implement the following compensating controls: (1) Disable remote management access to the web interface, restricting httpd access to trusted LAN clients only (blocks AV:N vector but limits legitimate remote admin). (2) Change default administrative credentials immediately to complex passwords (mitigates PR:L exploitation via credential guessing, though does not eliminate risk from compromised credentials). (3) Deploy network segmentation to isolate IoT/router management networks from critical assets (limits post-exploitation lateral movement despite CVSS scope already being contained). (4) Monitor router logs for unusual /goform/SetIpBind requests with abnormally large 'page' parameter values (detection-focused; high false-positive potential). (5) Consider replacing device with alternative vendor products if Tenda does not release timely security updates (operational disruption but eliminates vulnerability). Check https://www.tenda.com.cn/ and https://vuldb.com/vuln/359653 for vendor response updates.