Tenda F456 Routers Hit by Critical Remote Buffer Overflow
The National Vulnerability Database has disclosed a high-severity vulnerability, CVE-2026-6196, affecting Tenda F456 routers running firmware version 1.0.0.5. This flaw, a stack-based buffer overflow, resides within the fromexeCommand function of the /goform/exeCommand file. Attackers can trigger this vulnerability by manipulating the cmdinput argument.
What makes this particularly nasty is that the attack can be carried out remotely, and an exploit has already been made public. With a CVSS score of 8.8 (HIGH), this isn’t just a theoretical issue – it’s a critical remote code execution vector. The underlying weaknesses are categorized as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), classic memory corruption issues that often lead to full system compromise.
Related ATT&CK Techniques
🛡️ Detection Rules
4 rules · 5 SIEM formats4 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, and QRadar AQL.
Web Application Exploitation Attempt — CVE-2026-6196
Get this rule in your SIEM's native format — copy, paste, detect. No manual conversion.
4 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.
Get Detection Rules →Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6196 | Buffer Overflow | Tenda F456 version 1.0.0.5 |
| CVE-2026-6196 | Buffer Overflow | CWE-121: Stack-based Buffer Overflow |
| CVE-2026-6196 | Buffer Overflow | Vulnerable function: fromexeCommand in /goform/exeCommand |
| CVE-2026-6196 | Buffer Overflow | Vulnerable argument: cmdinput |
Related Posts
Critical RCE Flaw Hits NuGet Gallery Backend
CVE-2026-39399 — NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within...
BoidCMS LFI to RCE: A Critical Template Flaw
CVE-2026-39387 — BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are...
Nanobot AI: WebSocket Hijack Puts WhatsApp Sessions at Risk
CVE-2026-35589 — nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server...