CVE-2026-7470: Tenda 4G300 Router Vulnerable to Remote Stack Overflow

The National Vulnerability Database has disclosed CVE-2026-7470, a high-severity stack-based buffer overflow affecting the Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01 router. Specifically, a flaw exists in the sub_427C3C function within the /goform/SafeMacFilter file. Manipulating the page argument can trigger the overflow, leading to remote exploitation.

With a CVSSv3.1 score of 8.8 (High), this vulnerability presents a significant risk. The attack vector is network-based, requires low privileges, and does not need user interaction. Its impact is high on confidentiality, integrity, and availability, meaning an attacker could achieve remote code execution and full control over the device. The National Vulnerability Database also notes that an exploit has been published, escalating the urgency for remediation.

This is a critical issue for any organization or individual still relying on the affected Tenda 4G300 router. The existence of a public exploit dramatically lowers the bar for attackers, making these devices prime targets for initial access, network compromise, or use in botnets. Defenders must assume active exploitation is imminent or already underway.