Which versions of Tenda F456 are affected by EUVD-2026-25709?

Tenda F456 routers running firmware 1.0.0.5 are vulnerable to a buffer overflow that allows authenticated attackers to fully compromise device security and disrupt network operations.

Is there a public PoC exploit available for EUVD-2026-25709?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25709. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-25709?

Within 24 hours: Inventory all Tenda F456 routers and document firmware versions; disable remote management access if enabled. Within 7 days: Change all router administrative credentials to complex passwords; restrict management interface access to trusted networks only via firewall rules; contact Tenda support for patch timeline. Within 30 days: Evaluate replacement with alternative router vendor; implement network segmentation to isolate affected routers from critical systems; deploy network IDS signatures to detect exploitation attempts against SafeClientFilter function.

Tenda F456 EUVD-2026-25709

Q: What is the CVSS score of EUVD-2026-25709?

EUVD-2026-25709 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7033 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-26 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 29, 2026 - 22:33 vuln.today

Public exploit code

Analysis Updated

Apr 26, 2026 - 11:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 26, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Apr 26, 2026 - 11:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 26, 2026 - 11:00 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 10:30 euvd

EUVD-2026-25709

Analysis Generated

Apr 26, 2026 - 10:30 vuln.today

CVE Published

Apr 26, 2026 - 10:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Such manipulation of the argument menufacturer/Go leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Buffer overflow in Tenda F456 router firmware 1.0.0.5 allows authenticated remote attackers to achieve high-impact compromise of device confidentiality, integrity, and availability through crafted input to the SafeClientFilter function. A proof-of-concept exploit has been published on GitHub, increasing the likelihood of exploitation attempts against exposed management interfaces. While authentication is required (PR:L), the low attack complexity (AC:L) and network accessibility (AV:N) make this exploitable by attackers with basic router credentials.

Technical ContextAI

This vulnerability affects the fromSafeClientFilter function in the /goform/SafeClientFilter endpoint of Tenda F456 router firmware version 1.0.0.5. The flaw is a classic stack-based or heap-based buffer overflow (CWE-120) where user-controlled input parameters 'menufacturer' or 'Go' are copied into fixed-size buffers without proper bounds checking. Router web management interfaces written in C commonly exhibit this vulnerability class when handling POST parameters to CGI-like handlers under /goform/. The affected CPE (cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:*) indicates this is an application-layer vulnerability in the router's web management firmware, likely affecting the embedded HTTP server or management daemon processing client filtering rules.

RemediationAI

Check for firmware updates beyond version 1.0.0.5 from the official Tenda support site at https://www.tenda.com.cn/ - however, no confirmed patched version is identified in available data at time of analysis, and Tenda's history suggests patches may not be released for older hardware. If no patch exists, implement the following compensating controls in order of effectiveness: (1) Disable remote/WAN administration entirely if not required for business operations - this eliminates network-based attack vector but breaks remote management workflows. (2) Restrict management interface access to specific trusted IP addresses via firewall rules or access control lists - reduces exposure but requires static IP infrastructure and fails if attacker pivots from trusted network. (3) Change default credentials to strong unique passwords immediately - mitigates credential-based access (PR:L requirement) but does not prevent exploitation by authenticated users or after credential compromise. (4) Place affected devices behind a separate firewall/gateway and monitor for anomalous traffic to /goform/ endpoints - provides detection capability but does not prevent exploitation. Consider hardware replacement with actively supported models if Tenda does not release a patch within 30 days, as buffer overflows allow complete device takeover.