Is there a public PoC exploit available for CVE-2026-7469?

Yes, a public proof-of-concept exploit is available for CVE-2026-7469. Prioritise patching immediately. EPSS: 2.7%.

Tenda 4G300 CVE-2026-7469

Q: What is the CVSS score of CVE-2026-7469?

CVE-2026-7469 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.7%.

EUVD-2026-26306 LOW

Command Injection (CWE-77)

2026-04-30 VulDB

Tenda Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 20:41 vuln.today

Public exploit code

Severity Changed

Apr 30, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Apr 30, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Apr 30, 2026 - 02:14 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 02:00 euvd

EUVD-2026-26306

Analysis Generated

Apr 30, 2026 - 02:00 vuln.today

CVE Published

Apr 30, 2026 - 01:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation of the argument delflag results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in Tenda 4G300 US version 1.01.42 allows authenticated remote attackers to execute arbitrary system commands via the delflag parameter in the /goform/DelFil endpoint. The vulnerability affects the sub_425A28 function and has publicly available exploit code; CVSS 6.3 reflects authenticated access requirement but moderate impact scope.

Technical ContextAI

The vulnerability exists in the web management interface of the Tenda 4G300 router firmware. The /goform/DelFil endpoint processes user-supplied input through the delflag parameter without proper sanitization before passing it to system command execution functions. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the root cause is insufficient input validation when constructing or executing system commands. The affected function sub_425A28 is part of the router's file management functionality, suggesting the delflag parameter is intended to control file deletion operations but is instead interpretable as shell metacharacters or command operators.

RemediationAI

Immediate remediation requires contacting Tenda support to obtain a patched firmware version, as no official fix has been publicly released at the time of analysis. Interim compensating controls include: (1) Restrict network access to the router's web management interface to trusted IP addresses only using firewall rules, blocking the /goform/DelFil endpoint from untrusted sources. (2) Disable remote management features if not operationally required - most Tenda routers default to local-only access but may be exposed in cloud-managed deployments. (3) Change default or weak admin credentials and enforce strong authentication policies to reduce likelihood of account compromise. (4) Segment the router on a separate management VLAN with strict egress filtering to limit lateral movement if the device is compromised. Monitor Tenda's website (https://www.tenda.com.cn/) and contact support channels for security updates; CVE tracking and automatic security notifications are not available for this product line based on provided references.