CVE-2026-7030
Published: 26 April 2026
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2026-7030 is a buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5. It affects the fromRouteStatic function in the /goform/RouteStatic file, where manipulation of the "page" argument triggers the overflow. Published on 2026-04-26, the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially allowing full system compromise through the buffer overflow.
Advisories on VulDB (vuln/359610) and a GitHub repository provide details on the vulnerability, including a publicly disclosed exploit. The Tenda vendor site (tenda.com.cn) is referenced for potential mitigation guidance, though specific patch availability is not detailed in the primary sources.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in router web interface (/goform/RouteStatic) enables remote low-privilege exploitation over network for RCE, directly facilitating public-facing application exploitation (T1190) and privilege escalation (T1068).