CVE-2026-7102

MediumCVSS 6.3

Published: 27/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.32%

89th percentile - higher than 89% of all known CVEs

Summary

In Tenda F456 1.0.0.5, the FromWriteFacMac function in /goform/WriteFacMac (httpd component) does not neutralize the mac argument, leading to command injection. The attack can be executed remotely and the exploit has been made public.

Risk Assessment

A remote attacker can execute arbitrary commands on the device, taking control of the router and network.

Recommendation

Restrict administrative access to the device and check for Tenda firmware updates.

Other vulnerabilities in Tenda F456

CVE-2026-9389High
A buffer overflow vulnerability has been detected in the Tenda F456 device version 1.0.0.5 in the frmL7ImForm function of the /goform/L7Im file. The attack can be carried out remotely by manipulating the page argument. The exploit has been published and may be used.

Original NVD description (English source)

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS