A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
A flaw has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Executing a manipulation of the argument Go can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-7081 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. The flaw exists in the httpd component, specifically in the fromGstDhcpSetSer function handling the /goform/GstDhcpSetSer endpoint. Manipulating the 'dips' argument can trigger a buffer overflow, allowing remote exploitation without user interaction or privileges. Although an exploit is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-7080 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the httpd component, specifically the fromPPTPUserSetting function handling the delno argument in the /goform/PPTPUserSetting endpoint. This vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-7079 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the fromAdvSetWan function in the /goform/AdvSetWan component of the httpd service. The vulnerability is triggered by manipulating the wanmode argument, allowing remote attackers to cause a buffer overflow. Exploit code has been publicly released, increasing the risk of attacks. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and is specific to the stated firmware version.
CVE-2026-7078 is a high-severity buffer overflow vulnerability in the Tenda F456 router firmware version 1.0.0.5. The flaw exists in the fromSetIpBind function within the /goform/SetIpBind component of the httpd service. Remote attackers can exploit this vulnerability by manipulating the 'page' argument, potentially causing a buffer overflow. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the published date.
CVE-2026-7057 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It exists in an unknown function within the /goform/setcfm endpoint of the httpd component. The vulnerability is triggered by manipulating the funcname or funcpara1 arguments remotely, potentially allowing an attacker to cause a buffer overflow. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.
CVE-2026-7056 is a high-severity buffer overflow vulnerability in the Tenda F456 router version 1.0.0.5. It affects the fromSafeUrlFilter function in the /goform/SafeUrlFilter component of the httpd service. The vulnerability arises from improper handling of the 'page' argument, allowing remote attackers to cause a buffer overflow. Exploit code is publicly available, but no known exploits in the wild have been reported. No official patch or remediation guidance has been provided by the vendor as of now.
CVE-2026-7055 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the fromVirtualSer function in the /goform/VirtualSer component of the httpd service. The vulnerability arises from improper handling of the menufacturer/Go argument, allowing remote attackers to cause a buffer overflow. This issue has been publicly disclosed, but no known exploits are currently observed in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-7054 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the fromPptpUserAdd function in the /goform/PPTPDClient component of the device's HTTP server. The vulnerability arises from improper handling of the opttype/username argument, allowing remote attackers to cause a buffer overflow. Exploit code has been publicly released, increasing the risk of attacks. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-7053 is a high-severity buffer overflow vulnerability in the Tenda F456 router firmware version 1.0.0.5. The flaw exists in the function frmL7ProtForm within the /goform/L7Prot component of the httpd service. It can be triggered remotely by manipulating the 'page' argument, potentially allowing an attacker to cause a buffer overflow. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-7036 is a path traversal vulnerability in the HTTP Handler component (R7WebsSecurityHandlerfunction) of Tenda i9 version 1.0.0.5(2204). This flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files on the device. The vulnerability has a medium severity with a CVSS score of 6.9. Although an exploit is publicly available, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-7035 is a high-severity stack-based buffer overflow vulnerability in Tenda FH1202 version 1.2.0.14. It affects the httpd component, specifically the fromWrlclientSet function in the /goform/WrlclientSet file. An attacker can remotely exploit this by manipulating the Go argument, potentially causing a buffer overflow. The vulnerability has been publicly disclosed, but no official patch or remediation has been indicated yet.
CVE-2026-7034 is a high-severity stack-based buffer overflow vulnerability in the Tenda FH1202 router firmware version 1.2.0.14(408). The flaw exists in the WrlExtraSet function of the httpd component, where manipulation of the Go argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction or privileges. Although an exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Such manipulation of the argument menufacturer/Go leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in Tenda F456 1.0.0.5. Affected is the function SafeEmailFilter of the file /goform/SafeEmailFilter. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2026-7031 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It arises from improper handling of the 'page' argument in the fromSafeMacFilter function within the /goform/SafeMacFilter file. This flaw can be exploited remotely without user interaction or privileges. Although a public exploit exists, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-7029 is a high-severity buffer overflow vulnerability in the Tenda F456 router version 1.0.0.5. It exists in the fromaddressNat function of the /goform/addressNat file, where manipulation of the menufacturer/Go argument can trigger the overflow. The vulnerability is remotely exploitable without user interaction or privileges. Although an exploit is publicly available, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided yet.
A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.