CVE-2026-7470: Tenda 4G300 Buffer Overflow Vulnerability

CVE-2026-7470 Overview

CVE-2026-7470 is a stack-based buffer overflow vulnerability in the Tenda 4G300 router running firmware version US_4G300V1.0Mt_V1.01.42_CN_TDC01. The flaw resides in the function sub_427C3C accessed through the /goform/SafeMacFilter endpoint. An attacker can manipulate the page argument to overflow a fixed-size stack buffer. Exploitation is possible remotely over the network and a public exploit has been published. The vulnerability is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer.

Critical Impact

Remote attackers with low-privilege access can corrupt the device stack, potentially achieving arbitrary code execution on affected Tenda 4G300 routers.

Affected Products

• Tenda 4G300 router (hardware)
• Tenda 4G300 firmware version US_4G300V1.0Mt_V1.01.42_CN_TDC01
• Web management interface (/goform/SafeMacFilter handler)

Discovery Timeline

• 2026-04-30 - CVE-2026-7470 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7470

Vulnerability Analysis

The vulnerability exists in the sub_427C3C function, which handles requests sent to the /goform/SafeMacFilter URI on the Tenda 4G300 router's web management interface. The function processes the page parameter without enforcing length validation before copying user-supplied input into a fixed-size stack buffer.

When the attacker supplies an overlong page parameter, the copy operation writes beyond the buffer boundary and overwrites adjacent stack data, including the saved return address. An authenticated attacker reaching the web interface can deliver a crafted HTTP request to trigger the overflow. Successful exploitation can lead to denial of service or arbitrary code execution within the context of the web management process, which typically runs with elevated privileges on embedded routers.

Root Cause

The root cause is the absence of bounds checking on the page argument before it is copied into a stack-allocated buffer inside sub_427C3C. The function relies on unsafe string operations without validating input length against the destination buffer size, a common pattern in embedded MIPS/ARM router firmware.

Attack Vector

The attack vector is network based. An attacker who can reach the router's HTTP management interface and possesses low-privilege credentials can issue a POST request to /goform/SafeMacFilter with an oversized page parameter. The request payload triggers the stack overflow inside sub_427C3C, corrupting saved registers and the return address. Refer to the published proof-of-concept at Axelioc CVE Repository for technical reproduction details.

Detection Methods for CVE-2026-7470

Indicators of Compromise

• HTTP POST requests to /goform/SafeMacFilter containing abnormally long page parameter values exceeding typical pagination integers.
• Router crashes, reboots, or watchdog resets correlated with inbound HTTP traffic to the management interface.
• Unexpected processes or outbound connections originating from the router after web interface activity.

Detection Strategies

• Inspect HTTP request bodies and query strings to /goform/* endpoints for parameter values exceeding reasonable size thresholds (e.g., >256 bytes for numeric pagination fields).
• Deploy network intrusion detection signatures that flag requests targeting /goform/SafeMacFilter with binary or non-ASCII payloads in the page parameter.
• Correlate firmware version V1.01.42_CN_TDC01 device inventory data with exposure of the management interface to untrusted networks.

Monitoring Recommendations

• Centralize router syslog and crash telemetry to identify repeated daemon restarts indicative of exploitation attempts.
• Monitor for unauthorized changes to MAC filter, firewall, and DNS settings on Tenda 4G300 devices.
• Track inbound connections to the router HTTP management port from non-administrative source addresses.

How to Mitigate CVE-2026-7470

Immediate Actions Required

• Restrict access to the Tenda 4G300 web management interface to trusted internal management VLANs only and block WAN-side access.
• Change default and weak administrative credentials to reduce the risk posed by the low-privilege precondition for exploitation.
• Audit Tenda 4G300 deployments and identify devices running firmware US_4G300V1.0Mt_V1.01.42_CN_TDC01.

Patch Information

No vendor patch has been published at the time of CVE assignment. Refer to the Tenda Official Website for firmware update announcements. Additional vulnerability tracking is available via VulDB #360206.

Workarounds

• Disable remote (WAN) administration on affected Tenda 4G300 routers until a firmware patch is available.
• Place affected routers behind an upstream firewall and apply ACLs that restrict access to the management HTTP service.
• Where feasible, replace end-of-support Tenda 4G300 units with actively maintained network equipment.
• Apply network segmentation to isolate the router management plane from user and guest networks.

# Configuration example: restrict management interface access via upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP