CVE-2026-7098
Published: 27 April 2026
Summary
CVE-2026-7098 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F456 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7098 is a buffer overflow vulnerability in the Tenda F456 router running firmware version 1.0.0.5. The issue affects the fromDhcpListClient function within the /goform/DhcpListClient endpoint of the httpd component. By manipulating the "page" argument, an attacker can trigger the overflow remotely, as publicly disclosed in exploit details.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low complexity and requiring only low privileges, such as those of an authenticated user. Exploitation could allow an attacker to achieve high-impact confidentiality, integrity, and availability violations, potentially leading to remote code execution or full device compromise on affected routers.
Advisories from VulDB and related sources, including a GitHub proof-of-concept, detail the issue but do not specify patches in the provided information. Security practitioners should consult the vendor site at https://www.tenda.com.cn/ and references such as https://vuldb.com/vuln/359673 for mitigation guidance, firmware updates, or workarounds. The exploit is publicly available, increasing the risk of active use.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25798
Vulnerability details
A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The…
more
exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router's web management interface (/goform/DhcpListClient endpoint in httpd), remotely exploitable over network with low privileges (PR:L) leading to RCE and full compromise, directly enables exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the 'page' argument in the /goform/DhcpListClient endpoint to prevent buffer overflow from malformed input.
Requires timely remediation of the known buffer overflow flaw in the httpd component via firmware patching.
Implements memory protections like ASLR and DEP to mitigate exploitation of the buffer overflow vulnerability.