Vulnerability · Published Apr 27, 2026 · Assigned by VulDB
CVE-2026-7102Tenda F456 httpd WriteFacMac FromWriteFacMac command injection
Medium 6.3
In plain English
A medium-severity command injection in F456 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)3.3%top 11.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-359677 | Tenda F456 httpd WriteFacMac FromWriteFacMac command injection vdb-entry, technical-description
- VDB-359677 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #798475 | Tenda F456 v1.0.0.5 Command Injection third-party-advisory
- https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_140/README.md exploit
- https://www.tenda.com.cn/ product