Which versions of Tenda F456 are affected by CVE-2026-9389?

Tenda F456 routers (firmware 1.0.0.5) contain a buffer overflow vulnerability (CVSS 7.4) in the L7 packet filtering interface that allows low-privileged attackers to corrupt router memory via a…

Is there a public PoC exploit available for CVE-2026-9389?

Yes, a public proof-of-concept exploit is available for CVE-2026-9389. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9389?

Within 24 hours: Inventory all Tenda F456 devices on the network and identify which are running firmware 1.0.0.5; isolate from untrusted network segments if possible. Within 7 days: Implement strict network access controls limiting /goform/L7Im endpoint access to authorized administration sources only; enable request rate limiting on the affected endpoint if device management interface allows. Within 30 days: Monitor Tenda security advisories for patched firmware; plan device replacement or upgrade strategy with vendor timeline confirmation.

Tenda F456 CVE-2026-9389

Q: What is the CVSS score of CVE-2026-9389?

CVE-2026-9389 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31545 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-24 VulDB

GHSA-65p4-www8-vqx4

Tenda Buffer Overflow F456

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:16 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Buffer overflow in the Tenda F456 router (firmware 1.0.0.5) allows remote attackers with low privileges to corrupt memory via the page parameter handled by the frmL7ImForm function exposed at /goform/L7Im. Publicly available exploit code exists, though EPSS rates near-term exploitation probability at only 0.05% (14th percentile) and the issue is not listed in CISA KEV.

Technical ContextAI

The Tenda F456 is a SOHO/SMB router whose web management interface processes form submissions through goform endpoints implemented in the device's HTTP server. The vulnerable handler frmL7ImForm parses the page argument supplied to /goform/L7Im without enforcing proper bounds, triggering CWE-120 (Classic Buffer Overflow - copying input to a fixed-size buffer without length checks). On embedded MIPS/ARM router firmware, this class of flaw commonly enables memory corruption that can degrade service or, with sufficient exploit engineering, divert control flow within the httpd process running as root. The affected product is identified by CPE cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:* and the only confirmed affected firmware per ENISA EUVD-2026-31545 is F456 1.0.0.5.

RemediationAI

No vendor-released patch identified at time of analysis - neither the VulDB references nor the EUVD entry cite a fixed firmware build for the Tenda F456. Until Tenda publishes updated firmware, restrict reachability of the management interface by disabling remote/WAN-side administration (blocking inbound access to the device's HTTP/HTTPS admin port from untrusted networks), placing the router's LAN management plane on a segmented VLAN, and enforcing strong, unique administrator credentials since exploitation requires PR:L authenticated access. Where feasible, place an ACL or upstream firewall rule blocking external requests to the /goform/L7Im endpoint specifically; the side effect is loss of any legitimate remote management that traverses that path. Monitor Tenda's advisory page (https://www.tenda.com.cn/) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-9389) for firmware updates, and consider replacing the device if the vendor does not issue a fix.