Skip to content
CVSS 8.8 · HIGH

CVE-2026-7054

A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects the function fromPptpUserAdd of the file /goform/PPTPDClient of the component httpd. Executing a manipulation of the argument opttype/usernamewith can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Ver en NVD

Análisis

This is a buffer overflow in a specific model of Tenda consumer router firmware. The instructions explicitly list Tenda router firmware as an example of content that is not relevant to this developer community stack.

Severidad

Puntaje: 8.8(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: LOW
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-119CWE-120

EPSS

Probabilidad de explotación (próx. 30 días): 0.0008 (0.1%)
Percentil: 23.2%
EPSS: 2026-05-06

Afecta

tenda:f456_firmwaretenda:f456

Descripción técnica

A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects the function fromPptpUserAdd of the file /goform/PPTPDClient of the component httpd. Executing a manipulation of the argument opttype/usernamewith can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Publicada: 26/4/2026, 22:17:32
Última modificación: 29/4/2026, 22:28:40

Referencias

InicioEventosBlogRecursosEquipo