CVE-2026-7031
Remote Buffer Overflow in Tenda F456 SafeMacFilter Function
Publication date: 2026-04-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda F456 router version 1.0.0.5, specifically in the fromSafeMacFilter function of the /goform/SafeMacFilter endpoint.
The issue is a stack-based buffer overflow caused by improper handling of the "page" parameter in an HTTP POST request. When the "menufacturer" parameter is empty, the function uses the unchecked variable v6 in a sprintf call, which can overflow the stack buffer.
An attacker can exploit this by sending a specially crafted HTTP POST request with a very long "page" parameter and an empty "menufacturer" parameter, triggering the overflow.
This vulnerability allows remote attackers to cause denial of service or potentially execute arbitrary code on the device.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to denial of service, making the affected device unavailable.
More critically, it may allow remote code execution, enabling attackers to take control of the device remotely.
Such control could be used to disrupt network operations, intercept or manipulate data, or use the device as a foothold for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests targeting the /goform/SafeMacFilter endpoint on the Tenda F456 router version 1.0.0.5. Specifically, look for POST requests with an excessively long "page" parameter combined with an empty "menufacturer" parameter, which are indicators of an attempted exploit.
A practical detection method is to capture and analyze network traffic for such malicious POST requests.
- Use a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to /goform/SafeMacFilter.
- Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/SafeMacFilter'
- Inspect captured HTTP POST payloads for unusually long "page" parameter values and empty "menufacturer" parameters.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint and monitoring for exploit attempts.
- Block or filter incoming HTTP POST requests to /goform/SafeMacFilter from untrusted networks using firewall rules.
- Disable remote management of the Tenda F456 router if enabled, to reduce exposure.
- Monitor network traffic for signs of exploitation attempts as described in detection methods.
Since the exploit is public and the vulnerability allows remote code execution, applying an official firmware update or patch from the vendor, if available, is strongly recommended as a long-term solution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the Tenda F456 router allows remote code execution or denial of service, which could lead to unauthorized access or disruption of network services.
Such security weaknesses may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of personal and sensitive data through secure systems and networks.
If exploited, this vulnerability could compromise the confidentiality, integrity, and availability of data processed or transmitted by the affected device, potentially leading to violations of these regulations.