CVE-2026-7056
Published: 26 April 2026
Summary
CVE-2026-7056 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7056 is a buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5. The flaw affects the fromSafeUrlFilter function in the /goform/SafeUrlFilter file of the httpd component. Manipulation of the page argument triggers the buffer overflow, classified under CWE-119 and CWE-120.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Attackers with low privileges can exploit it remotely over the network with low complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially resulting in remote code execution.
References point to a public exploit in a GitHub repository at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_127/README.md and VulDB entries including https://vuldb.com/vuln/359629. The description confirms the exploit is public and usable, with no vendor patches or specific mitigations detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25726
Vulnerability details
A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be performed from remote. The exploit…
more
is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web server (/goform/SafeUrlFilter) directly enables remote exploitation for RCE on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow by identifying, reporting, and correcting the specific flaw in the fromSafeUrlFilter function through timely firmware patching.
Prevents exploitation by validating and sanitizing the manipulated 'page' argument in the /goform/SafeUrlFilter endpoint to avoid buffer overflow conditions.
Mitigates successful buffer overflow exploitation by implementing memory protections like address space layout randomization and data execution prevention in the httpd process.