Tenda F456 CVE-2026-7102

Q: What is the CVSS score of CVE-2026-7102?

CVE-2026-7102 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.7%.

EUVD-2026-25802 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-27 cna@vuldb.com

Tenda Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Apr 27, 2026 - 09:31 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25802

Analysis Generated

Apr 27, 2026 - 09:22 vuln.today

CVE Published

Apr 27, 2026 - 09:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Command injection in Tenda F456 1.0.0.5 httpd allows authenticated remote attackers to execute arbitrary commands via the mac parameter in the /goform/WriteFacMac endpoint. The vulnerability has a publicly available exploit and CVSS 5.3 score with authenticated access requirement (PR:L), limiting immediate widespread risk but affecting exposed or compromised administrative accounts.

Technical ContextAI

The Tenda F456 is a residential router with an embedded HTTP daemon (httpd) handling administrative requests. The vulnerable function FromWriteFacMac processes input from the /goform/WriteFacMac endpoint without proper sanitization of the mac parameter, leading to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The mac parameter is likely passed unsanitized to a shell command or system() call, permitting command injection through shell metacharacters. This affects the router's management interface accessible via its web console.

RemediationAI

Vendor patch availability and version information are not documented in the provided references. Immediate workarounds include: (1) Restrict access to the /goform/WriteFacMac endpoint via firewall rules blocking HTTP/HTTPS to the router's management interface from untrusted networks, permitting access only from trusted administrative machines; (2) Change default administrative credentials to strong, unique passwords; (3) Disable remote management features in the router's settings if they are not required; (4) Isolate the router on a dedicated VLAN with strict access controls. Contact Tenda support via https://www.tenda.com.cn/ to obtain patched firmware versions for Tenda F456. Test any firmware updates in a non-production environment before deployment. If a patched version becomes available, apply it immediately and reset administrative credentials post-patch.