The vulnerability CVE-2026-7080 affects Tenda F456 version 1.0.0.5 and is caused by improper handling of the delno argument in the fromPPTPUserSetting function within the httpd component. This leads to a buffer overflow condition that can be triggered remotely via the /goform/PPTPUserSetting endpoint. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch from the vendor.

Successful exploitation of this buffer overflow vulnerability may allow an unauthenticated remote attacker to cause a denial of service or potentially execute arbitrary code on the affected device. This could compromise the confidentiality, integrity, and availability of the router and the network it serves. No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the affected device to untrusted networks and monitor for updates from Tenda. No vendor-provided mitigation or temporary fix is currently documented.