The device sitting in your hallway or on top of your TV cabinet — the one that connects everything in your home to the internet — may be quietly waiting for a stranger on the other side of the world to take it over completely.
Who's at Risk, and Why It Matters
The Tenda 4G300 is a compact 4G wireless router popular with home users, small offices, and remote workers who rely on mobile broadband where fixed-line internet isn't available. Tenda is one of the world's best-selling router brands, with hundreds of millions of devices shipped globally. If you bought a budget-friendly 4G router in the last few years — particularly in China, Southeast Asia, Eastern Europe, or via gray-market imports — there's a real chance you own one.
The vulnerability, tracked as CVE-2026-7470 and rated 8.8 out of 10 (HIGH) on the severity scale, means an attacker anywhere on the internet can potentially take full control of your router without ever setting foot near your home. Once they own your router, they own your internet connection — and everything on your network.
That includes your smart TV, your laptop, your phone, your baby monitor, and anything else connected to your Wi-Fi. In a small business context, that could mean customer data, payment systems, or internal communications.
What an Attacker Can Actually Do
Imagine your router as the front door to your entire digital home. This vulnerability is the equivalent of a hidden master key that any stranger can use — no password, no invitation required. An attacker sends a specially crafted request to your router over the internet, targeting a specific administrative page used to manage which devices are allowed on your network. Instead of following normal rules, the router gets confused and crashes in a way that lets the attacker slip in their own instructions.
Once inside, the attacker has the keys to the kingdom. They can reroute your internet traffic through their own servers — meaning every website you visit, every login you type, every message you send could be silently intercepted and read. They can use your router as a launchpad for attacks on others, making your home internet connection the apparent origin of cybercrime. They can block specific websites, redirect you to fake banking pages, or simply watch everything you do online, invisibly, for months.
The scariest part? You'd likely never know it was happening. Your internet would still work. Your devices would still connect. Everything would look perfectly normal while a stranger watched from the inside.
The Technical Detail Security Researchers Need to Know
The vulnerability is a stack-based buffer overflow in the function sub_427C3C, located in the router's firmware file responsible for handling the /goform/SafeMacFilter endpoint. The attack vector is the page argument — an attacker can supply an oversized string that overflows the stack buffer, corrupting the return address and enabling arbitrary code execution at the firmware level. Given that embedded router firmware typically runs as root with no privilege separation, successful exploitation yields full system access with no further escalation required. The affected firmware version is US_4G300V1.0Mt_V1.01.42_CN_TDC01.
Has Anyone Been Attacked Yet?
As of publication, no active exploitation in the wild has been confirmed — but the situation is deteriorating fast. The exploit has already been publicly published, meaning the technical recipe for attacking vulnerable routers is freely available to anyone who searches for it. In the security world, the window between "exploit published" and "attackers actively using it" is often measured in hours, not days.
The vulnerability was discovered and responsibly disclosed by independent security researchers, and it has been assigned a CVE identifier through standard coordinated disclosure processes. No specific threat actor or criminal campaign has been publicly attributed to this flaw yet — but historically, router vulnerabilities with public exploits are rapidly absorbed into botnet recruitment tools and automated scanning campaigns. The Mirai botnet family, which famously disrupted large chunks of the internet in 2016, was built almost entirely on unpatched router flaws exactly like this one.
Security teams monitoring network perimeters should treat this as an active threat given the public exploit availability.
What You Should Do Right Now
-
Check your router model and firmware version immediately.
Log into your router's admin panel (usually by visiting192.168.0.1or192.168.1.1in your browser). Navigate to the system information or device status page and confirm whether you own a Tenda 4G300 running firmware version V1.01.42. If you do, you are vulnerable and should act on the steps below without delay. -
Check for a firmware update — and disable remote management now.
Visit Tenda's official support site (tendacn.com) and search for the 4G300 to see if an updated firmware version beyond V1.01.42 has been released. Install any available update immediately. While you're in the admin panel, find the "Remote Management" or "WAN Access" settings and disable them entirely — this reduces the attack surface even on an unpatched device by preventing the vulnerable endpoint from being reached directly from the internet. -
If no patch is available, consider replacing the device.
Tenda has a mixed track record of patching older budget router models. If no updated firmware appears within the next 7–14 days, seriously consider replacing the 4G300 with a device from a vendor with an active security patching program. In the meantime, avoid connecting sensitive devices — work laptops, banking phones, medical devices — to the network running on this router, and consider using a mobile data connection or VPN for sensitive transactions until the situation is resolved.
Bottom line: A publicly available exploit for a HIGH-severity flaw in a widely used router is a five-alarm situation. The clock is ticking. Check your device today.
CVE-2026-7470 | CVSS 8.8 HIGH | Affected: Tenda 4G300 firmware US_4G300V1.0Mt_V1.01.42_CN_TDC01 | Category: Stack-Based Buffer Overflow | Remote Exploitation: Possible