CVE-2026-7056

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-705605.4Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticate CVE-2026-705616.5TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privi CVE-2026-705627.0Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-705638.1Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a n CVE-2026-705647.8Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-705657.0Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.CVE-2026-705667.8Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.CVE-2026-705677.0Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.CVE-2026-705687.0Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2026-705697.8Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.CVE-2026-70578.8A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. CVE-2026-705708.1Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine