Which versions of Tenda F456 are affected by CVE-2026-7097?

CVE-2026-7097 is a remote code execution vulnerability in Tenda F456 routers (firmware 1.0.0.5) that allows authenticated users with low-privilege credentials to fully compromise the device through…

Is there a public PoC exploit available for CVE-2026-7097?

Yes, a public proof-of-concept exploit is available for CVE-2026-7097. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7097?

Within 24 hours: Inventory all Tenda F456 routers and identify those running firmware 1.0.0.5; disable or restrict web management access to trusted networks only via firewall rules. Within 7 days: Change all default and shared credentials on affected devices; implement network segmentation to isolate router management traffic; contact Tenda for patch timeline. Within 30 days: Replace vulnerable Tenda F456 units with patched firmware versions once available, or substitute with alternative vendor equipment from a manufacturer actively maintaining security updates.

Tenda F456 CVE-2026-7097

Q: What is the CVSS score of CVE-2026-7097?

CVE-2026-7097 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25788 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-27 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:27 vuln.today

Public exploit code

Analysis Updated

Apr 27, 2026 - 08:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 27, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Apr 27, 2026 - 08:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 27, 2026 - 07:45 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 07:30 euvd

EUVD-2026-25788

Analysis Generated

Apr 27, 2026 - 07:30 vuln.today

CVE Published

Apr 27, 2026 - 07:00 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise the device via buffer overflow in the httpd web management interface. Exploitation requires low-privilege credentials but enables complete device takeover (CVSS 7.4). A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier to active exploitation despite requiring authentication.

Technical ContextAI

This vulnerability affects the httpd web server component of Tenda F456 wireless router firmware version 1.0.0.5 (cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*). The flaw is a classic buffer overflow (CWE-120) in the fromwebExcptypemanFilter function within the /goform/webExcptypemanFilter endpoint. When processing the 'page' parameter, insufficient bounds checking allows an attacker to write beyond allocated memory boundaries. Buffer overflows in embedded device web interfaces commonly occur in C-based httpd implementations where unsafe string functions (strcpy, sprintf) are used without input validation. On MIPS or ARM-based routers like Tenda devices, successful exploitation typically overwrites return addresses on the stack to redirect execution flow, achieving arbitrary code execution with the privileges of the httpd process (usually root on consumer routers).

RemediationAI

Check Tenda's official support portal (https://www.tenda.com.cn/) for firmware updates newer than 1.0.0.5 that address CVE-2026-7097, though no vendor-released patch version is confirmed in available intelligence at time of analysis. Until patching is confirmed available, implement network-level compensating controls: (1) Disable remote web management access entirely and restrict httpd to LAN-only access via firewall rules on the WAN interface - this eliminates the AV:N attack vector but prevents legitimate remote administration; (2) Change default administrative credentials to complex unique passwords (16+ characters) to mitigate credential-based access, though this only raises attacker cost rather than eliminating the vulnerability; (3) Place the router behind a properly configured firewall/UTM that can block exploitation attempts, though this requires DPI capabilities to inspect /goform/ POST requests; (4) Segment the network so router compromise does not grant access to critical assets. If remote management is business-critical, consider replacing the device with enterprise-grade equipment that receives timely security updates. The public exploit code (https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_135/README.md) should be reviewed to understand specific attack patterns for WAF rule development.