CVE-2026-7102
Published: 27 April 2026
Summary
CVE-2026-7102 is a low-severity Injection (CWE-74) vulnerability in Tenda F456 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7102 affects Tenda F456 firmware version 1.0.0.5 and resides in the FromWriteFacMac function of the /goform/WriteFacMac endpoint within the httpd component. The flaw is a command-injection issue that arises when the mac argument is manipulated, corresponding to CWE-74 and CWE-77.
An authenticated remote attacker can supply a crafted mac value to the endpoint and execute arbitrary commands on the device. The CVSS 4.0 vector indicates network access with low attack complexity and low privileges, and a publicly available exploit has already been disclosed.
EPSS for the vulnerability rose from a low baseline to a recorded peak of 0.0273 before settling at the current value of 0.0104, indicating increased exploitation interest after disclosure. No vendor advisory or patch information is provided in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25802
Vulnerability details
A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has…
more
been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router's public-facing web interface (httpd /goform) enables exploitation of public-facing application (T1190) and facilitates arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents command injection by requiring validation of the 'mac' argument in the FromWriteFacMac function to ensure only valid inputs are processed.
SI-2 mandates identification and remediation of flaws like this command injection vulnerability through firmware patching.
AC-6 limits the impact of successful command injection by enforcing least privilege on the httpd process handling the vulnerable endpoint.