CVE-2026-7030
Published: 26 April 2026
Summary
CVE-2026-7030 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7030 is a buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5. It affects the fromRouteStatic function in the /goform/RouteStatic file, where manipulation of the "page" argument triggers the overflow. Published on 2026-04-26, the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially allowing full system compromise through the buffer overflow.
Advisories on VulDB (vuln/359610) and a GitHub repository provide details on the vulnerability, including a publicly disclosed exploit. The Tenda vendor site (tenda.com.cn) is referenced for potential mitigation guidance, though specific patch availability is not detailed in the primary sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25705
Vulnerability details
A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has…
more
been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (/goform/RouteStatic) enables remote low-privilege exploitation over network for RCE, directly facilitating public-facing application exploitation (T1190) and privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow vulnerability in Tenda F456 firmware by requiring identification, reporting, and patching of flaws like CVE-2026-7030.
Prevents exploitation by enforcing validation of the 'page' argument in /goform/RouteStatic to restrict operations within memory buffer bounds.
Mitigates buffer overflow exploitation through memory protection mechanisms such as stack canaries, ASLR, and DEP in the affected firmware.