Tenda F456 HTTP Server Arbitrary Command Execution

The vulnerability of the FromWriteFacMac function /goform/WriteFacMac in the httpd microprogramming software for Tenda F456 routers is related to the lack of measures to sanitize input data when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2026-7102

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be...

CVE-2026-7102

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be...

CVE-2026-7102

CVE-2026-7102 affects Tenda F456 firmware 1.0.0.5, specifically the httpd component’s FromWriteFacMac function in /goform/WriteFacMac. The vulnerability arises from manipulating the mac argument, leading to command injection. The issue can be exploited remotely, and public exploits exist. Details...

PT-2026-35378

Name of the Vulnerable Software and Affected Versions Tenda F456 version 1.0.0.5 Description A remote command injection issue exists in the httpd component. The problem occurs within the FromWriteFacMac function of the /goform/WriteFacMac file. Manipulation of the mac argument allows a remote...

Tenda F456 injection vulnerability

The Tenda F456 is a wireless router produced by the Chinese company Tenda. Version 1.0.0.5 of the Tenda F456 contains a vulnerability caused by the FromWriteFacMac function in the httpd component or the goform/WriteFacMac file. This vulnerability arises from the handling of the parameter “mac” in...

CVE-2026-7102: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be...