CVE-2026-7029
Published: 26 April 2026
Summary
CVE-2026-7029 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7029 is a buffer overflow vulnerability affecting the Tenda F456 router running firmware version 1.0.0.5. The issue resides in the fromaddressNat function within the /goform/addressNat file, where manipulation of the menufacturer/Go argument triggers the overflow. Classified under CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, potentially granting high-impact confidentiality, integrity, and availability compromises, such as full device takeover.
Advisories referenced in VulDB entries (vuln/359609 and related pages) document the issue and a public exploit submission, while a GitHub repository provides a proof-of-concept in its README.md. The vendor's site (tenda.com.cn) is listed but offers no specific patch details in the provided references.
The exploit has been publicly disclosed and could be used in attacks, heightening risk for unpatched Tenda F456 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25704
Vulnerability details
A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /goform/addressNat. Executing a manipulation of the argument menufacturer/Go can lead to buffer overflow. The attack may be performed from remote. The…
more
exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in web interface (/goform/addressNat) enables remote exploitation of public-facing application (T1190) and privilege escalation from low privileges (PR:L) to arbitrary code execution and full device takeover (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 ensures timely remediation of the buffer overflow flaw in the fromaddressNat function by applying vendor firmware patches for CVE-2026-7029.
SI-10 requires validation of inputs like the menufacturer/Go argument to prevent buffer overflows in the /goform/addressNat endpoint exploited in CVE-2026-7029.
SI-16 implements memory protections such as non-executable stacks and ASLR to mitigate arbitrary code execution from the buffer overflow in CVE-2026-7029.