CVE-2026-7019
Published: 26 April 2026
Summary
CVE-2026-7019 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7019 is a buffer overflow vulnerability affecting the Tenda F456 router running firmware version 1.0.0.5. The issue resides in the fromP2pListFilter function within the /goform/P2pListFilter file, where manipulation of the "menufacturer/Go" argument triggers the overflow. Associated with CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability consequences, potentially allowing arbitrary code execution, data theft, or device compromise. A public exploit is available, increasing the risk of widespread abuse.
Advisories and details are documented in references including VulDB entries (vuldb.com/vuln/359598 and related pages), a GitHub repository at github.com/Litengzheng/vuldb_new/blob/main/F456/vul_118/README.md detailing the exploit, and the vendor site at tenda.com.cn. No specific patch or mitigation steps are outlined in the provided CVE details, but practitioners should consult these sources for remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25694
Vulnerability details
A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit…
more
is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web form handler (/goform/P2pListFilter) directly enables remote exploitation of a public-facing application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of the specific buffer overflow flaw in the Tenda F456 /goform/P2pListFilter function.
Mandates validation and bounds checking of the 'menufacturer/Go' argument to directly prevent buffer overflow exploitation.
Deploys memory protections like DEP and ASLR to block arbitrary code execution resulting from the buffer overflow.