CVE-2026-7054
Published: 26 April 2026
Summary
CVE-2026-7054 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow flaw in the fromPptpUserAdd function by applying vendor patches or firmware updates to prevent exploitation.
Validates opttype and usernamewith inputs to the /goform/PPTPDClient endpoint, preventing buffer overflows from improper restriction of operations within memory bounds.
Implements memory safeguards like ASLR and DEP to protect against arbitrary code execution even if the buffer overflow in httpd is triggered.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web interface (/goform/PPTPDClient) enables remote authenticated RCE on the router.
NVD Description
A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects the function fromPptpUserAdd of the file /goform/PPTPDClient of the component httpd. Executing a manipulation of the argument opttype/usernamewith can lead to buffer overflow. The attack can be executed…
more
remotely. The exploit has been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2026-7054 is a buffer overflow vulnerability in the Tenda F456 router running firmware version 1.0.0.5. The issue resides in the fromPptpUserAdd function within the /goform/PPTPDClient endpoint of the httpd component. By manipulating the opttype and usernamewith arguments, an attacker can trigger the overflow, as identified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low attack complexity, and low privileges required. An authenticated remote attacker with low privileges can exploit it over the network without user interaction, potentially achieving full confidentiality, integrity, and availability compromise, such as arbitrary code execution on the device.
Advisories and details are documented on VulDB (vuln/359627 and related pages), with a public exploit available via a GitHub repository at Litengzheng/vuldb_new/blob/main/F456/vul_125/README.md. The vendor Tenda's site (tenda.com.cn) is referenced, though specific patch information is not detailed in available sources. Security practitioners should monitor these for updates and apply firmware upgrades if available. The exploit's public disclosure heightens the risk of real-world attacks on unpatched Tenda F456 devices.
Details
- CWE(s)