CVE-2026-7031
Published: 26 April 2026
Summary
CVE-2026-7031 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7031 is a buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5, published on 2026-04-26. The flaw affects the fromSafeMacFilter function in the /goform/SafeMacFilter file, where manipulation of the "page" argument triggers the overflow. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network by attackers possessing low privileges, such as authenticated users. Successful exploitation requires low attack complexity and no user interaction, potentially granting high impacts on confidentiality, integrity, and availability, including the possibility of remote code execution.
Advisories referenced on VulDB detail the issue and include a public exploit available on GitHub at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_121/README.md. Security practitioners should review vendor guidance on the Tenda website (https://www.tenda.com.cn/) for patches or mitigations, as the public exploit increases the risk of active use against unpatched devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25706
Vulnerability details
A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public…
more
and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in web form handler (/goform/SafeMacFilter) of public-facing router firmware enables remote code execution via exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the buffer overflow flaw in the Tenda F456 firmware's fromSafeMacFilter function.
Mandates validation of the 'page' argument input to the /goform/SafeMacFilter endpoint to prevent buffer overflow exploitation.
Implements memory safeguards such as non-executable memory regions to mitigate remote code execution from the buffer overflow vulnerability.