Tenda f456 vulnerabilities

6 CVEs affecting Tenda f456, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9389, published 2026-05-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-9389, published 2026-05-24. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The…
CVE-2026-6200, published 2026-04-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go…
CVE-2026-6199, published 2026-04-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda F456 1.0.0.5. Impacted is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page results in stack-based buffer overflow.…
CVE-2026-6198, published 2026-04-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda F456 1.0.0.5. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to…
CVE-2026-6197, published 2026-04-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mit_ssid can lead to…
CVE-2026-6196, published 2026-04-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda F456 1.0.0.5. This affects the function fromexeCommand of the file /goform/exeCommand. Performing a manipulation of the argument cmdinput results in stack-based…