F456 CVE-2026-6196

Requires valid low-privileged authentication credentials to the Tenda F456 router web management interface. The vulnerable /goform/exeCommand endpoint is part of the authenticated web administration interface, not accessible to unauthenticated remote attackers. Exploitation depends on the router's web management interface being network-accessible to the attacker, either from the LAN segment or through enabled remote management features. The CVSS vector PR:L (low privileges required) confirms this is not an unauthenticated attack scenario.

Real-world risk is moderate despite the high CVSS 7.4 score. The CVSS v4.0 vector shows concerning characteristics: network-accessible (AV:N), low complexity (AC:L), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). However, it requires low-privileged authentication (PR:L), significantly reducing the attack surface. The EPSS score of 0.05% (14th percentile) indicates security researchers assess actual exploitation probability as very low in real-world environments. Publicly available exploit code exists on GitHub, lowering the skill barrier, but absence from CISA KEV confirms no observed mass exploitation campaigns. The vulnerability requires attackers to first compromise router admin credentials, making it more valuable as a post-compromise persistence mechanism than an initial access vector. Organizations using Tenda F456 routers in consumer or small office environments face higher risk than enterprises with network segmentation and strong credential management. This is a legitimate vulnerability requiring remediation but not an emergency patch requiring immediate action like a KEV-listed RCE with unauthenticated remote exploitation.

An attacker who has obtained valid router administrative credentials (through credential stuffing, default passwords, or phishing) accesses the Tenda F456 web management interface over the network. They send a crafted HTTP POST request to the /goform/exeCommand endpoint with an oversized cmdinput parameter value containing shellcode. The fromexeCommand function copies this data without bounds checking, overflowing the stack buffer and overwriting the return address to redirect execution to the attacker's injected code, resulting in arbitrary command execution with router firmware privileges.