CVE-2026-7469: Tenda 4G300 DelFil sub_425A28 command injection

Published Apr 30, 2026

Updated

A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation of the argument delflag results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

Affected Software

3 affected components

Tenda Tenda 4G300=US_4G300V1.0Mt_V1.01.42_CN_TDC01

All of the following

Tenda 4g300 Firmware=1.01.42_cn_tdc01

Tenda 4G300

Event History

Apr 30, 2026

CVE Published

via MITRE·01:45 AM

Data Sourced

via MITRE·01:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeaknessAffected Software

Dec 23, 58314

Event

via FIRST·11:37 PM

Frequently Asked Questions

What is the severity of CVE-2026-7469?

CVE-2026-7469 is classified as a high-severity vulnerability due to its potential for remote command injection.

How can I fix CVE-2026-7469?

To mitigate CVE-2026-7469, it is recommended to update the Tenda 4G300 device to the latest firmware version provided by the vendor.

What impact does CVE-2026-7469 have on the Tenda 4G300?

CVE-2026-7469 allows an attacker to execute arbitrary commands on the Tenda 4G300 device via a specially crafted request.

Is CVE-2026-7469 a remote vulnerability?

Yes, CVE-2026-7469 can be exploited remotely over the network.

Which version of Tenda 4G300 is affected by CVE-2026-7469?

CVE-2026-7469 affects Tenda 4G300 with the firmware version US_4G300V1.0Mt_V1.01.42_CN_TDC01.

CVSS Score

6.3Medium

Medium Severity

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Security Metrics

Risk Score34

Severitylow(2.1)

EPSS3.733%

CWE

7774

Timeline

PublishedApr 30, 2026

Updated

References

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.