EUVD-2026-31545
GHSA-65p4-www8-vqx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed F456 admin interface
-
DeliveryObtain low-privilege web UI credentials
-
ExploitSend crafted POST to /goform/L7Im with oversized page parameter
-
ExecutionTrigger buffer overflow in frmL7ImForm
-
PersistCorrupt httpd memory for DoS or code execution
-
ImpactPivot into LAN or persist on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the F456's HTTP management interface and valid low-privilege credentials to the router web UI (CVSS PR:L). The target must be running firmware 1.0.0.5 and have the /goform/L7Im endpoint exposed to the attacker's network position - typically the LAN side, since SOHO routers usually do not expose admin HTTP to the WAN by default. No user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Exploitation is LIMITED by: the authentication requirement, the niche deployment footprint of this specific Tenda model, and the lack of any documented unauthenticated chain that would expose the bug to anonymous internet scanners. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 - network-reachable, low complexity, but requiring low-level privileges (PR:L), meaning an attacker needs at least authenticated access to the router's web UI before triggering the overflow. EPSS is very low (0.05%, percentile 14%) and the CVE is not in CISA KEV, indicating no observed in-the-wild campaigns despite the public PoC on GitHub. SSVC signals were not provided in the input, but the combination of authenticated precondition, niche SOHO product, and absence of KEV listing suggests this is a moderate-priority defensive concern rather than an emergency: the high CIA impact (VC:H/VI:H/VA:H) is real, but exploitation is gated by the need for valid credentials or a chained auth bypass, neither of which is documented here. Note the scope-unchanged flags (SC:N/SI:N/SA:N) - impact is confined to the router itself. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials to the F456 web UI - obtained via phishing, default/reused passwords, or a separate auth bypass - sends a crafted POST to /goform/L7Im with an oversized page argument, triggering the buffer overflow in frmL7ImForm. Using the publicly disclosed PoC at github.com/Litengzheng/vuldb_new, the attacker crashes the router's HTTP daemon for denial of service, or with additional exploitation effort attempts to hijack control flow inside the httpd process to gain code execution on the device. A compromised router could then be used to pivot into the LAN, intercept traffic, or be conscripted into a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Buffer overflow in the Tenda F456 router (firmware 1.0.0.5) allows remote attackers with low privileges to corrupt memory via the page parameter handled by the frmL7ImForm function exposed at /goform/L7Im. Publicly available exploit code exists, though EPSS rates near-term exploitation probability at only 0.05% (14th percentile) and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - neither the VulDB references nor the EUVD entry cite a fixed firmware build for the Tenda F456. Until Tenda publishes updated firmware, restrict reachability of the management interface by disabling remote/WAN-side administration (blocking inbound access to the device's HTTP/HTTPS admin port from untrusted networks), placing the router's LAN management plane on a segmented VLAN, and enforcing strong, unique administrator credentials since exploitation requires PR:L authenticated access. Where feasible, place an ACL or upstream firewall rule blocking external requests to the /goform/L7Im endpoint specifically; the side effect is loss of any legitimate remote management that traverses that path. Monitor Tenda's advisory page (https://www.tenda.com.cn/) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-9389) for firmware updates, and consider replacing the device if the vendor does not issue a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda F456 is a SOHO/SMB router whose web management interface processes form submissions through goform endpoints implemented in the device's HTTP server. The vulnerable handler frmL7ImForm parses the page argument supplied to /goform/L7Im without enforcing proper bounds, triggering CWE-120 (Classic Buffer Overflow - copying input to a fixed-size buffer without length checks). On embedded MIPS/ARM router firmware, this class of flaw commonly enables memory corruption that can degrade service or, with sufficient exploit engineering, divert control flow within the httpd process running as root. The affected product is identified by CPE cpe:2.3:a:tenda:f456:*:*:*:*:*:*:*:* and the only confirmed affected firmware per ENISA EUVD-2026-31545 is F456 1.0.0.5.
Know when F456 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Tenda F456 routers (firmware 1.0.0.5) contain a buffer overflow vulnerability (CVSS 7.4) in the L7 packet filtering interface that allows low-privileged attackers to corrupt router memory via a single network request. Organizations using this model face potential network disruption or device compromise; the public availability of working exploit code accelerates the timeline to mass exploitation despite current low EPSS probability.
Network segmentation (restrict router management access to trusted administrative networks only); rate limiting on the /goform/L7Im endpoint to slow exploitation attempts; disable remote management features if not required; real-time monitoring for unexpected router reboots or memory errors. Publicly available exploit code elevates risk despite low near-term EPSS; compensating controls are temporary until vendor patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB