CVE-2026-7079
Published: 27 April 2026
Summary
CVE-2026-7079 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7079 is a buffer overflow vulnerability affecting the Tenda F456 router on firmware version 1.0.0.5. The flaw exists in the fromAdvSetWan function of the /goform/AdvSetWan file within the httpd component, where manipulation of the wanmode argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2026-04-27 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network with low attack complexity and requires only low privileges, such as those of an authenticated user, with no user interaction needed. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to full device compromise, including arbitrary code execution.
Advisories and references, including VulDB entries at https://vuldb.com/vuln/359654 and the Tenda website at https://www.tenda.com.cn/, provide further details; a public exploit is available at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_130/README.md and could be used for attacks. No specific patch details are outlined in the CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25762
Vulnerability details
A weakness has been identified in Tenda F456 1.0.0.5. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. This manipulation of the argument wanmode causes buffer overflow. The attack may be initiated remotely. The exploit has…
more
been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web interface (/goform/AdvSetWan) on network device enables remote authenticated RCE leading to full compromise, directly mapping to T1190 for exploiting the public-facing application and T1068 for escalating from low privileges to arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely patching of known flaws like the buffer overflow in Tenda F456's fromAdvSetWan function, directly remediating CVE-2026-7079.
SI-10 enforces validation of user inputs such as the wanmode argument in the httpd /goform/AdvSetWan endpoint, preventing the buffer overflow exploitation.
SI-16 provides runtime memory protections to block arbitrary code execution resulting from buffer overflows in the vulnerable httpd component.