CVE-2026-7102mediumCWE-74CWE-77

CVE-2026-7102: medium-severity vulnerability in Tenda F456

Tenda F456 httpd WriteFacMac FromWriteFacMac command injection

Published · Updated

Follow this CVE+ Monitor F456

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 3.3%
A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · F456
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Tenda F456

In the same product, most dangerous first.

CVE-2026-7082HIGHTenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflowEPSS 2.6%CVE-2026-7097HIGHTenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflowEPSS 0.8%CVE-2026-7033HIGHTenda F456 SafeClientFilter fromSafeClientFilter buffer overflowEPSS 0.7%CVE-2026-7054HIGHTenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflowEPSS 0.7%CVE-2026-7031HIGHTenda F456 SafeMacFilter fromSafeMacFilter buffer overflowEPSS 0.7%CVE-2026-7055HIGHTenda F456 httpd VirtualSer fromVirtualSer buffer overflowEPSS 0.7%