Cyber Posture

CVE-2026-7057

HighPublic PoC

Published: 26 April 2026

Published
26 April 2026
Modified
29 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0008 23.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7057 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates timely remediation of the known buffer overflow flaw in Tenda F456 firmware version 1.0.0.5 via patching or upgrades.

prevent

Requires validation of inputs like funcname and funcpara1 at the /goform/setcfm endpoint to prevent buffer overflows from improper restriction of operations within memory bounds.

prevent

Implements memory protections such as address space layout randomization and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in public-facing httpd web interface (/goform/setcfm) on Tenda F456 firmware enables remote exploitation for arbitrary code execution with low privileges and no user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. This manipulation of the argument funcname/funcpara1 causes buffer overflow. It is possible to initiate the attack…

more

remotely. The exploit has been published and may be used.

Deeper analysisAI

CVE-2026-7057 is a buffer overflow vulnerability affecting Tenda F456 firmware version 1.0.0.5. The flaw resides in an unknown function within the /goform/setcfm file of the httpd component, triggered by manipulation of the funcname and funcpara1 arguments. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

The vulnerability enables remote exploitation by attackers with low privileges (PR:L). Low attack complexity and no user interaction are required, allowing network-accessible adversaries to trigger the buffer overflow. Successful exploitation can result in high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.

Advisories and related resources, including a GitHub repository containing a published exploit at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_128/README.md, detail the issue via VulDB entries (https://vuldb.com/vuln/359630, https://vuldb.com/submit/798459, https://vuldb.com/vuln/359630/cti). The vendor's site (https://www.tenda.com.cn/) is referenced, though specific patch details are not outlined in available descriptions. Security practitioners should monitor these for mitigation guidance.

Exploits have been publicly disclosed, increasing the risk of real-world abuse against unpatched Tenda F456 devices.

Details

CWE(s)

Affected Products

tenda
f456 firmware
1.0.0.5

CVEs Like This One

CVE-2026-7098Same product: Tenda F456
CVE-2026-7081Same product: Tenda F456
CVE-2026-7054Same product: Tenda F456
CVE-2026-7056Same product: Tenda F456
CVE-2026-7053Same product: Tenda F456
CVE-2026-7031Same product: Tenda F456
CVE-2026-7033Same product: Tenda F456
CVE-2026-7101Same product: Tenda F456
CVE-2026-7080Same product: Tenda F456
CVE-2026-7097Same product: Tenda F456

References