CVE-2026-7099
Remote Buffer Overflow in Tenda F456 httpd Component
Publication date: 2026-04-27
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack-based buffer overflow found in the Tenda F456 version 1.0.0.5, specifically in the HTTP daemon's formQuickIndex function. It occurs when the parameter "mit_linktype" is set to 2 and an excessively long "PPPOEPassword" value is sent without proper validation or length checking. This causes the buffer to overflow, which can be exploited by sending a specially crafted HTTP POST request to the /goform/QuickIndex endpoint.
The overflow can lead to denial of service (DoS) or remote code execution (RCE), allowing an attacker to crash the service or execute arbitrary code remotely on the affected device.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including denial of service (DoS), where the affected device's service crashes or becomes unavailable.
More critically, it can allow remote code execution (RCE), meaning an attacker could run arbitrary code on your device remotely. This could lead to unauthorized control over the device, data breaches, or further attacks within your network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the /goform/QuickIndex endpoint, specifically those containing the parameter mit_linktype=2 combined with an unusually long PPPOEPassword value.
A practical detection method is to capture and analyze network traffic for such crafted POST requests that may trigger the buffer overflow.
For example, using command-line tools like curl or wget, you can simulate the exploit attempt to verify if the system is vulnerable:
- curl -X POST http://[target-ip]/goform/QuickIndex -d "mit_linktype=2&PPPOEPassword=$(python3 -c 'print("A"*1000)')"
Alternatively, network intrusion detection systems (NIDS) can be configured to alert on HTTP POST requests to /goform/QuickIndex with mit_linktype=2 and large payload sizes in PPPOEPassword.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Tenda F456 allows remote code execution or denial of service via a buffer overflow in the HTTP daemon. Such a vulnerability can lead to unauthorized access, data breaches, or service disruption.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, exploitation of this vulnerability could potentially result in violations of these regulations due to unauthorized access or compromise of sensitive data.
Organizations using the affected device should consider this vulnerability a risk to their compliance posture and take appropriate mitigation steps to prevent data breaches or service interruptions that could lead to regulatory non-compliance.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /goform/QuickIndex by implementing firewall rules or access control lists to block unauthorized or external HTTP POST requests.
Additionally, monitoring and blocking HTTP requests containing mit_linktype=2 with large PPPOEPassword parameters can help prevent exploitation.
If possible, update the device firmware to a version where this vulnerability is patched or contact the vendor for security updates.
As a temporary measure, disabling the HTTP service or limiting its exposure to trusted networks can reduce the attack surface.