CVE-2026-7080
Remote Buffer Overflow in Tenda F456 httpd Component
Publication date: 2026-04-27
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-7080 vulnerability affects the Tenda F456 router, version 1.0.0.5. It is a stack-based buffer overflow found in the HTTP daemon (httpd), specifically within the fromPPTPUserSetting function.
This function processes a user-supplied parameter named "delno." When "delno" is not empty, its value is assigned to a variable which is then passed to the sprintf function without any bounds checking on its length.
Because there is no validation on the length of "delno," this can cause a stack-based buffer overflow, allowing an attacker to exploit the vulnerability by sending a crafted HTTP POST request with an excessively long "delno" parameter.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to denial of service (DoS) or remote code execution (RCE) on the affected device.
An attacker can remotely crash the system or execute arbitrary code by sending a specially crafted HTTP POST request to the vulnerable endpoint.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the endpoint /goform/PPTPUserSetting containing an excessively long "delno" parameter.
A practical detection method is to capture and analyze HTTP traffic targeting the Tenda F456 router, specifically looking for POST requests with unusually large payloads in the "delno" field.
For example, using command-line tools like curl or network packet analyzers such as tcpdump or Wireshark can help identify such attempts.
- Use curl to simulate or detect suspicious requests: curl -X POST -d "delno=$(python3 -c 'print("a"*1000)')" http://<router-ip>/goform/PPTPUserSetting
- Use tcpdump to capture HTTP POST requests to the vulnerable endpoint: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep "/goform/PPTPUserSetting"
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable HTTP endpoint /goform/PPTPUserSetting to trusted networks only, such as by applying firewall rules.
Additionally, monitoring and blocking HTTP POST requests with unusually large "delno" parameters can help prevent exploitation.
If possible, update the router firmware to a version that patches this vulnerability or apply vendor-provided security updates.
Until a patch is available, disabling remote management or HTTP access to the router from untrusted networks is recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-7080 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.