CVE-2026-7029
Published: 26 April 2026
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2026-7029 is a buffer overflow vulnerability affecting the Tenda F456 router running firmware version 1.0.0.5. The issue resides in the fromaddressNat function within the /goform/addressNat file, where manipulation of the menufacturer/Go argument triggers the overflow. Classified under CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, potentially granting high-impact confidentiality, integrity, and availability compromises, such as full device takeover.
Advisories referenced in VulDB entries (vuln/359609 and related pages) document the issue and a public exploit submission, while a GitHub repository provides a proof-of-concept in its README.md. The vendor's site (tenda.com.cn) is listed but offers no specific patch details in the provided references.
The exploit has been publicly disclosed and could be used in attacks, heightening risk for unpatched Tenda F456 devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in web interface (/goform/addressNat) enables remote exploitation of public-facing application (T1190) and privilege escalation from low privileges (PR:L) to arbitrary code execution and full device takeover (T1068).