CVE-2026-7078
Remote Buffer Overflow in Tenda F456 httpd Allows Exploits
Publication date: 2026-04-27
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7078 is a stack-based buffer overflow vulnerability in the Tenda F456 router version 1.0.0.5. It occurs in the httpd service within the fromSetIpBind function, which processes a user-supplied parameter named "page." The parameter is passed to the sprintf function without proper bounds checking, causing the stack buffer to overflow.
An attacker can exploit this vulnerability remotely by sending a specially crafted HTTP POST request to the /goform/SetIpBind endpoint with an excessively long "page" parameter, potentially leading to denial of service or remote code execution.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including causing a denial of service on the affected device or allowing an attacker to execute arbitrary code remotely. This means an attacker could potentially take control of the router, disrupt network services, or use the device as a foothold for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the endpoint /goform/SetIpBind that contain an unusually long or malformed "page" parameter.
A practical detection method is to capture and analyze network traffic for such requests.
- Use a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to /goform/SetIpBind.
- Example tcpdump command: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/SetIpBind'
- Inspect the POST data for the "page" parameter and check if its length is unusually large or contains suspicious content.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint and preventing exploitation attempts.
- Block or filter HTTP POST requests to /goform/SetIpBind at the network perimeter or firewall.
- Apply input validation or length checks on the "page" parameter if you have control over the device or firmware.
- Update the Tenda F456 router firmware to a version that patches this vulnerability once available.
- Monitor logs and network traffic for signs of exploitation attempts.