CVE-2026-9389
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A buffer overflow vulnerability has been detected in the Tenda F456 device version 1.0.0.5 in the frmL7ImForm function of the /goform/L7Im file. The attack can be carried out remotely by manipulating the page argument. The exploit has been published and may be used.
Risk Assessment
The risk includes remote code execution or device crash, which could lead to network disruption or device takeover.
Recommendation
It is recommended to immediately update the Tenda F456 firmware to the latest version if available, or apply temporary network security measures to block access to the vulnerable interface.
Other vulnerabilities in Tenda F456
Original NVD description (English source)
A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS