Tenda F456 Router Buffer Overflow Vulnerability (CVE-2026-7097)

A buffer overflow vulnerability, identified as CVE-2026-7097, has been discovered in Tenda F456 router version 1.0.0.5. The vulnerability resides in the fromwebExcptypemanFilter function within the /goform/webExcptypemanFilter component of the device's httpd server. Successful exploitation of this vulnerability allows a remote attacker to cause a buffer overflow by manipulating the page argument, potentially leading to arbitrary code execution on the affected device. Given the public availability of exploit code, this vulnerability poses a significant risk to users of the Tenda F456 router.

Attack Chain

1. The attacker identifies a Tenda F456 router with firmware version 1.0.0.5 exposed to the internet.
2. The attacker crafts a malicious HTTP request targeting the /goform/webExcptypemanFilter endpoint.
3. The attacker includes a specially crafted page argument within the HTTP request, designed to overflow the buffer in the fromwebExcptypemanFilter function.
4. The httpd server processes the request and calls the vulnerable function.
5. The fromwebExcptypemanFilter function copies the attacker-controlled page argument into a fixed-size buffer without proper bounds checking.
6. The buffer overflow corrupts adjacent memory regions, potentially overwriting critical data or code pointers.
7. The attacker redirects program execution to attacker-controlled code by overwriting a return address.
8. The attacker achieves remote code execution on the Tenda F456 router, potentially gaining full control of the device.

Impact

Successful exploitation of CVE-2026-7097 can lead to complete compromise of the Tenda F456 router. This allows attackers to execute arbitrary code, potentially enabling them to modify device settings, intercept network traffic, or use the compromised device as part of a botnet. Given the ease of exploitation with publicly available exploits, a widespread attack targeting vulnerable Tenda routers is possible.

Recommendation

• Monitor web server logs for requests to /goform/webExcptypemanFilter with unusually long page parameters using the provided Sigma rule.
• Implement rate limiting on HTTP requests to the /goform/webExcptypemanFilter endpoint to mitigate potential exploitation attempts.
• Consider deploying a web application firewall (WAF) rule to filter out malicious requests targeting CVE-2026-7097 based on the payload structure.