Which versions of Tenda F456 are affected by CVE-2026-7079?

Tenda F456 router firmware 1.0.0.5 is vulnerable to authenticated remote code execution via buffer overflow in WAN configuration, enabling complete device compromise.

Is there a public PoC exploit available for CVE-2026-7079?

Yes, a public proof-of-concept exploit is available for CVE-2026-7079. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7079?

Within 24 hours: Inventory all Tenda F456 routers in production and document firmware versions; restrict administrative access to these devices via network segmentation and disable remote management interfaces. Within 7 days: Contact Tenda support for patch availability and timeline; implement compensating controls by enforcing strong authentication and monitoring administrative access logs for suspicious activity. Within 30 days: Deploy patch immediately upon availability or replace affected devices with firmware versions later than 1.0.0.5; conduct network forensics on all F456 devices to detect prior unauthorized access.

Tenda F456 CVE-2026-7079

Q: What is the CVSS score of CVE-2026-7079?

CVE-2026-7079 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25762 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-27 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:37 vuln.today

Public exploit code

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 03:31 vuln.today

CVSS changed

Apr 27, 2026 - 03:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 03:00 euvd

EUVD-2026-25762

Analysis Generated

Apr 27, 2026 - 03:00 vuln.today

CVE Published

Apr 27, 2026 - 02:30 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda F456 1.0.0.5. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. This manipulation of the argument wanmode causes buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise device integrity and confidentiality via buffer overflow in the WAN configuration interface. The vulnerability exploits the fromAdvSetWan function's improper handling of the wanmode parameter, enabling complete device takeover. Public exploit code exists on GitHub (Litengzheng/vuldb_new), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector, low complexity (AC:L), and publicly available POC makes this a realistic threat to exposed management interfaces.

Technical ContextAI

The vulnerability resides in the httpd web server component of Tenda F456 router firmware, specifically in the /goform/AdvSetWan endpoint which handles WAN (Wide Area Network) configuration settings. The fromAdvSetWan function fails to validate the length of the wanmode parameter before copying it to a fixed-size buffer, triggering a classic stack-based or heap-based buffer overflow (CWE-120). This is a common vulnerability class in embedded device web interfaces written in C/C++ without proper bounds checking. The affected CPE is cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*, indicating the application firmware running on Tenda F456 hardware. Buffer overflows in router management interfaces typically allow attackers to overwrite return addresses or function pointers, enabling arbitrary code execution with the privileges of the httpd daemon (typically root on embedded Linux systems).

RemediationAI

Check the official Tenda support website (https://www.tenda.com.cn/) for firmware updates beyond version 1.0.0.5 that address this buffer overflow vulnerability, though no patched version is confirmed in available data at time of analysis. If no official patch exists, implement the following compensating controls with noted trade-offs: (1) Disable remote management access to the router's web interface from WAN-side connections-this prevents internet-based exploitation but does not protect against LAN-based attackers or malware on the internal network; (2) Change default administrative credentials to strong, unique passwords (minimum 16 characters, mixed case, numbers, symbols)-this raises the authentication barrier but does not eliminate risk if credentials are compromised via phishing or brute-force; (3) Implement network segmentation to isolate the router's management interface on a dedicated VLAN accessible only from trusted administrator workstations-this limits attack surface but adds configuration complexity; (4) Deploy intrusion detection signatures monitoring for requests to /goform/AdvSetWan with abnormally long wanmode parameter values (>256 bytes)-this provides detection but not prevention. For high-security environments, consider replacing affected devices with alternative router models that receive active security support, as Tenda F456 appears to be an older model with uncertain ongoing vendor support.