CVE-2026-7055
Published: 26 April 2026
Summary
CVE-2026-7055 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7055 is a buffer overflow vulnerability affecting the Tenda F456 router on firmware version 1.0.0.5. The flaw exists in the fromVirtualSer function within the /goform/VirtualSer file of the httpd component, triggered by manipulation of the "menufacturer/Go" argument.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is remotely exploitable. Attackers with low privileges, such as authenticated users, can trigger the buffer overflow over the network with low complexity and no user interaction, potentially achieving high impacts on confidentiality, integrity, and availability, including remote code execution.
Advisories detail the issue on VulDB at https://vuldb.com/vuln/359628 and https://vuldb.com/vuln/359628/cti, with a proof-of-concept exploit publicly disclosed on GitHub at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_126/README.md. Additional submission details are at https://vuldb.com/submit/798457, and the vendor site is https://www.tenda.com.cn/. The exploit has been disclosed publicly and may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25725
Vulnerability details
A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be…
more
carried out remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the httpd web component (/goform/VirtualSer) of a public-facing router web interface, remotely exploitable for RCE, directly maps to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the buffer overflow flaw in the Tenda F456 httpd component through firmware patches or updates.
Mandates validation of the 'menufacturer/Go' argument in the fromVirtualSer function to prevent buffer overflow exploitation.
Deploys memory protections like ASLR and stack canaries to mitigate remote code execution from the buffer overflow.