Which versions of Tenda F456 are affected by CVE-2026-7101?

Tenda F456 router firmware 1.0.0.5 contains a buffer overflow vulnerability in the web management interface that allows authenticated users to execute arbitrary code on the device.

How to fix or mitigate CVE-2026-7101?

Within 24 hours: Inventory all Tenda F456 devices on the network and document firmware versions. Within 7 days: Restrict network access to the router's web management interface (/goform/WrlclientSet endpoint) using firewall rules and disable remote management if not essential. Within 30 days: Monitor Tenda advisories for firmware patches and plan upgrades immediately upon release; consider replacing devices if patches do not materialize within 90 days.

Tenda F456 CVE-2026-7101

Q: What is the CVSS score of CVE-2026-7101?

CVE-2026-7101 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25801 HIGH

Buffer Overflow (CWE-119)

2026-04-27 cna@vuldb.com

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 09:31 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25801

Analysis Generated

Apr 27, 2026 - 09:22 vuln.today

CVE Published

Apr 27, 2026 - 09:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda F456 1.0.0.5. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

Buffer overflow in Tenda F456 router firmware version 1.0.0.5 allows authenticated remote attackers to achieve code execution via crafted requests to the /goform/WrlclientSet endpoint. The vulnerability exists in the fromWrlclientSet function of the httpd component. Public exploit code is available on GitHub, increasing practical exploitation risk despite requiring low-privilege authentication (CVSS 7.4, EPSS data not provided).

Technical ContextAI

The vulnerability resides in the httpd web server component of Tenda F456 router firmware, specifically within the fromWrlclientSet function that handles requests to the /goform/WrlclientSet endpoint. This endpoint appears to manage wireless client settings. The root cause is a CWE-119 improper restriction on operations within the bounds of a memory buffer, commonly known as a buffer overflow. When processing malformed input to this function, the httpd service fails to validate buffer boundaries, allowing an attacker to write beyond allocated memory. This class of vulnerability can lead to arbitrary code execution by overwriting critical data structures, return addresses, or function pointers in the router's memory space.

RemediationAI

Check for firmware updates newer than version 1.0.0.5 on the Tenda support website (https://www.tenda.com.cn/) and apply immediately if available. Vendor-released patch status is not independently confirmed from the provided data. As compensating controls until patching: (1) Disable remote web interface access and restrict management to local network only via router administration settings - this reduces attack surface but does not protect against LAN-based attackers or malicious insiders; (2) Change default administrative credentials to strong, unique passwords immediately - this raises the authentication barrier but does not eliminate risk if credentials are compromised via phishing or network sniffing; (3) Implement network segmentation to isolate the router's management interface from untrusted network segments - effective but requires additional network infrastructure. Note that all workarounds only mitigate, not eliminate, the vulnerability. The /goform/WrlclientSet endpoint may be essential for wireless client management functionality, so disabling it entirely may impact normal operations. Monitor for unauthorized access attempts and unusual administrative sessions.