CVE-2026-7080
Published: 27 April 2026
Summary
CVE-2026-7080 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7080 is a buffer overflow vulnerability in Tenda F456 routers running firmware version 1.0.0.5. The flaw affects the httpd component, specifically the fromPPTPUserSetting function exposed via the /goform/PPTPUserSetting endpoint. Manipulation of the delno argument triggers the buffer overflow, as associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low attack complexity and requiring only low privileges, without user interaction. An attacker with such access can achieve high impacts on confidentiality, integrity, and availability, potentially leading to remote code execution or denial of service.
References point to a GitHub repository containing the publicly disclosed exploit, VulDB entries (including submission and CTI details), and the Tenda vendor website. Security practitioners should consult these sources and the vendor for any available patches or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25763
Vulnerability details
A security vulnerability has been detected in Tenda F456 1.0.0.5. This impacts the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. Such manipulation of the argument delno leads to buffer overflow. The attack may be launched remotely. The…
more
exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web server (/goform/PPTPUserSetting) on the router directly enables remote exploitation of a public-facing application, mapping to T1190; high-impact RCE/DoS with low privileges and no user interaction confirms this.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow in the fromPPTPUserSetting function by applying vendor patches to eliminate the vulnerability.
Information input validation enforces checks on the delno argument to prevent buffer overflows from improper input handling in the httpd component.
Memory protection mechanisms like address space layout randomization and data execution prevention mitigate exploitation of the buffer overflow for remote code execution.