CVE-2026-7057
Published: 26 April 2026
Summary
CVE-2026-7057 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7057 is a buffer overflow vulnerability affecting Tenda F456 firmware version 1.0.0.5. The flaw resides in an unknown function within the /goform/setcfm file of the httpd component, triggered by manipulation of the funcname and funcpara1 arguments. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L). Low attack complexity and no user interaction are required, allowing network-accessible adversaries to trigger the buffer overflow. Successful exploitation can result in high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.
Advisories and related resources, including a GitHub repository containing a published exploit at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_128/README.md, detail the issue via VulDB entries (https://vuldb.com/vuln/359630, https://vuldb.com/submit/798459, https://vuldb.com/vuln/359630/cti). The vendor's site (https://www.tenda.com.cn/) is referenced, though specific patch details are not outlined in available descriptions. Security practitioners should monitor these for mitigation guidance.
Exploits have been publicly disclosed, increasing the risk of real-world abuse against unpatched Tenda F456 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25727
Vulnerability details
A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. This manipulation of the argument funcname/funcpara1 causes buffer overflow. It is possible to initiate the attack…
more
remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web interface (/goform/setcfm) on Tenda F456 firmware enables remote exploitation for arbitrary code execution with low privileges and no user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the known buffer overflow flaw in Tenda F456 firmware version 1.0.0.5 via patching or upgrades.
Requires validation of inputs like funcname and funcpara1 at the /goform/setcfm endpoint to prevent buffer overflows from improper restriction of operations within memory bounds.
Implements memory protections such as address space layout randomization and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.