CVE-2026-7055

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	F456	1.0.0.5

References

https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_126/README.mdExploit, Vendor Advisory
https://vuldb.com/submit/798457Third Party Advisory, VDB Entry
https://vuldb.com/vuln/359628Third Party Advisory, VDB Entry
https://vuldb.com/vuln/359628/ctiPermissions Required, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Apr 26, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-705506.5An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to r CVE-2026-705518.5A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.CVE-2026-705529.8MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers t CVE-2026-705539.8MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the appli CVE-2026-705549.8MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacke CVE-2026-705556.5rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH,CVE-2026-705564.3Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Mo CVE-2026-705576.5diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and retur CVE-2026-705589.8Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(CVE-2026-705597.5Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits t CVE-2026-70568.8A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the comp CVE-2026-705605.4Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticate