Which versions of Tenda F456 are affected by CVE-2026-7098?

Tenda F456 routers (version 1.0.0.5) are vulnerable to remote code execution through the web management interface, allowing attackers with low-privilege HTTP credentials to execute arbitrary commands…

How to fix or mitigate CVE-2026-7098?

Within 24 hours: Identify all Tenda F456 v1.0.0.5 devices in production using network scanning or asset management systems; restrict HTTP management interface access to trusted IP ranges via firewall rules. Within 7 days: Change all default credentials on identified devices; disable remote management access if not operationally required; implement network segmentation to isolate router management from untrusted zones. Within 30 days: Monitor vendor advisories for patch availability; evaluate replacement with alternative router models from vendors with active security support; conduct forensic review of firewall logs for unauthorized management interface access.

Tenda F456 CVE-2026-7098

Q: What is the CVSS score of CVE-2026-7098?

CVE-2026-7098 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25798 HIGH

Buffer Overflow (CWE-119)

2026-04-27 cna@vuldb.com

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 09:30 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25798

Analysis Generated

Apr 27, 2026 - 09:22 vuln.today

CVE Published

Apr 27, 2026 - 09:16 nvd

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Remote authenticated attackers can execute arbitrary code on Tenda F456 router version 1.0.0.5 via buffer overflow in the DhcpListClient function of the httpd component. Exploitation requires low-privilege HTTP authentication and targets the web management interface. A public proof-of-concept exploit exists on GitHub (Litengzheng/vuldb_new), enabling straightforward weaponization. EPSS data unavailable, but the combination of remote attack vector, low complexity (AC:L), and publicly disclosed exploit code indicates elevated real-world exploitation risk for internet-exposed devices with default or weak credentials.

Technical ContextAI

The vulnerability resides in the httpd web server daemon of Tenda F456 firmware version 1.0.0.5, specifically within the fromDhcpListClient function handling requests to the /goform/DhcpListClient endpoint. This endpoint processes DHCP client list requests in the router's web management interface. The function fails to validate the length of the 'page' parameter before copying it into a fixed-size buffer, triggering a classic stack-based or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The httpd component runs with elevated privileges on embedded router firmware, making successful exploitation particularly dangerous. As a network infrastructure device, the F456 router processes untrusted network input, and buffer overflow vulnerabilities in web management interfaces are a common attack surface in SOHO routers where security development practices lag behind enterprise-grade devices.

RemediationAI

Check for firmware updates on the official Tenda support website (tenda.com.cn) for F456 model, though no patched version is confirmed in available vendor communications at time of analysis. As an immediate compensating control, disable remote management access to the web interface and restrict administrative access to trusted internal IP addresses only via firewall rules or the router's access control settings. Change default administrative credentials to strong unique passwords (minimum 16 characters with mixed case, numbers, symbols) to raise the authentication barrier, noting this is risk reduction not elimination since the vulnerability affects authenticated sessions. Consider replacing the device with a router from a vendor with active security support if Tenda does not release a patch within 30 days, as end-of-life consumer routers rarely receive timely security updates. Network segmentation to isolate the router's management plane from untrusted networks provides defense-in-depth but does not address attacks from compromised internal hosts. Monitor router logs for unusual administrative login attempts or access to /goform/ endpoints as potential exploitation indicators, though embedded device logging is often limited.