CVE-2026-7100
Remote Buffer Overflow in Tenda F456 httpd Natlimit Function
Publication date: 2026-04-27
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f456_firmware | 1.0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7100 is a critical buffer overflow vulnerability found in the Tenda F456 router version 1.0.0.5. The flaw exists in the httpd service, specifically in the fromNatlimit function that processes a user-supplied parameter called "page."
The vulnerability occurs because the "page" parameter is passed directly to the sprintf function without any bounds checking, allowing an attacker to overflow a stack-based buffer by sending an excessively long value in an HTTP POST request to the /goform/Natlimit endpoint.
Exploitation of this vulnerability can lead to denial of service (DoS) or remote code execution (RCE) on the affected device.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including denial of service (DoS), where the affected router may crash or become unresponsive.
More critically, it can allow remote code execution (RCE), enabling an attacker to run arbitrary code on the device remotely, potentially taking full control of the router.
Such control could be used to intercept network traffic, manipulate network settings, or launch further attacks on connected devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests to the /goform/Natlimit endpoint containing an excessively long "page" parameter. Such requests may indicate attempts to exploit the buffer overflow.
A practical detection method is to capture and analyze network traffic targeting the Tenda F456 router's httpd service, specifically looking for POST requests with unusually large payloads in the "page" parameter.
For example, using curl to simulate or detect such requests:
- curl -X POST http://[router_ip]/goform/Natlimit -d "page=$(python3 -c 'print("a"*1000)')"
To detect exploitation attempts on your network, you can use packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to /goform/Natlimit with large "page" parameters.
- tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/Natlimit'
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /goform/Natlimit endpoint by implementing network-level controls such as firewall rules to block external HTTP POST requests to this path.
Additionally, limit administrative access to the Tenda F456 router to trusted networks or IP addresses only.
If possible, disable the httpd service or the vulnerable functionality until a patch or firmware update is available.
Monitor the device logs and network traffic for signs of exploitation attempts, and apply any official firmware updates from the vendor addressing this vulnerability as soon as they are released.