PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9389 Tenda CVE debrief

A buffer overflow vulnerability in the Tenda F456 router firmware version 1.0.0.5 allows remote attackers to execute arbitrary code via the `page` parameter in the `/goform/L7Im` endpoint's `frmL7ImForm` function. The vulnerability has a CVSS 4.0 score of 7.4 (HIGH severity) and public exploit disclosure increases immediate risk. The affected product is a consumer-grade wireless router, and successful exploitation could lead to complete device compromise. No CISA KEV listing or vendor patch is confirmed at this time.

Vendor
Tenda
Product
F456
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-07-23
Advisory published
2026-05-24
Advisory updated
2026-07-23

Who should care

Network administrators managing Tenda F456 deployments; security teams responsible for consumer-grade router infrastructure; SOHO and residential users with this device model; incident response teams tracking IoT exploitation campaigns

Technical summary

The vulnerability exists in the `frmL7ImForm` function handling HTTP POST requests to `/goform/L7Im` on Tenda F456 firmware 1.0.0.5. Insufficient bounds checking on the `page` parameter allows stack-based or heap-based buffer overflow, potentially enabling remote code execution with privileges of the web server process. The attack requires network connectivity to the router's web interface and valid low-privilege credentials or session. CVSS 4.0 scoring: Attack Vector (AV): Network, Attack Complexity (AC): Low, Attack Requirements (AT): None, Privileges Required (PR): Low, User Interaction (UI): None, Confidentiality Impact (VC): High, Integrity Impact (VI): High, Availability Impact (VA): High, Exploit Maturity (E): Proof-of-concept.

Defensive priority

HIGH

Recommended defensive actions

  • Segment or restrict network access to Tenda F456 router management interfaces; disable remote administration if enabled
  • Monitor for anomalous HTTP requests to `/goform/L7Im` containing oversized `page` parameters
  • Apply firmware updates from Tenda when available; verify version exceeds 1.0.0.5
  • Consider replacing device if vendor patch timeline is unacceptable given public exploit availability
  • Review device placement in network architecture; isolate from critical assets

Evidence notes

Vulnerability confirmed via Vuldb CNA submission with public proof-of-concept. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction. Weaknesses mapped to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). Vendor attribution to Tenda based on reference domain evidence with low confidence; product identification from vulnerability description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9389 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9389

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9389 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9389

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.