CVE-2026-7081
Published: 27 April 2026
Summary
CVE-2026-7081 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7081 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda F456 firmware version 1.0.0.5. The issue resides in the fromGstDhcpSetSer function within the /goform/GstDhcpSetSer file of the httpd component, where manipulation of the "dips" argument triggers the overflow. Published on 2026-04-27, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise via the buffer overflow.
Advisories and details are available through VulDB entries (vuln/359656 and related CTI/submit pages), a GitHub repository containing the public exploit (Litengzheng/vuldb_new), and the official Tenda website (tenda.com.cn), which security practitioners should consult for any firmware updates or mitigation guidance.
The exploit code is publicly available, increasing the risk of widespread abuse against unpatched Tenda F456 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25764
Vulnerability details
A vulnerability was detected in Tenda F456 1.0.0.5. Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. Performing a manipulation of the argument dips results in buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web interface (/goform/GstDhcpSetSer) enables remote exploitation for arbitrary code execution on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow vulnerability in Tenda F456 httpd's GstDhcpSetSer function through timely firmware patching.
Enforces validation and bounds checking on the 'dips' argument to prevent buffer overflow in the affected /goform/GstDhcpSetSer endpoint.
Implements memory safeguards like non-executable stacks and ASLR to block arbitrary code execution from the buffer overflow exploitation.