CVE-2026-7054
Remote Buffer Overflow in Tenda F456 HTTPD Component
Publication date: 2026-04-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda F456 version 1.0.0.5, specifically in the function fromPptpUserAdd within the /goform/PPTPDClient file of the httpd component.
It involves a buffer overflow caused by improper handling of the argument opttype/username, which can be manipulated remotely by an attacker.
Because the exploit is publicly available, attackers can use it to compromise affected devices.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to a buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device.
Since the attack can be performed remotely, it increases the risk of unauthorized access or control over the device without physical access.
The CVSS scores indicate a high severity, reflecting significant potential impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Tenda F456 1.0.0.5 allows remote attackers to cause a buffer overflow via manipulation of the opttype/username argument, potentially leading to unauthorized access or control.
Such unauthorized access or control could lead to breaches of confidentiality, integrity, and availability of data, which are critical aspects addressed by common standards and regulations like GDPR and HIPAA.
Therefore, if exploited, this vulnerability could result in non-compliance with these regulations due to potential data breaches or loss of data integrity.