F456 CVE-2026-6198

Authenticated access to the Tenda F456 router's web management interface is required. The attacker must possess valid administrative credentials (typically admin username with associated password) to reach the /goform/NatStaticSetting endpoint where the fromNatStaticSetting function processes the vulnerable 'page' parameter. The CVSS vector PR:L confirms low-privilege authentication is the primary prerequisite. Exploitation additionally requires network connectivity to the management interface, which may be exposed on WAN interfaces if remote administration is enabled in router settings, or requires LAN/WLAN access if management is restricted to internal interfaces only.

Real-world risk assessment reveals moderate priority despite CVSS 7.4 High severity. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity, but requires authenticated access to the router's management interface, significantly reducing the attack surface compared to unauthenticated vulnerabilities. EPSS score of 0.05% (14th percentile) suggests very low probability of mass exploitation in the wild, consistent with targeted consumer router firmware vulnerabilities that lack widespread scanning campaigns. Public exploit availability (GitHub POC) lowers the skill barrier but no CISA KEV listing confirms active exploitation campaigns. SSVC decision factors: exploitation is POC (not active), automatable potential is limited by authentication requirement, technical impact is total (code execution as root on embedded device). This represents a real risk for organizations using affected Tenda routers in production environments, but lower priority than unauthenticated RCE or actively exploited vulnerabilities. Primary risk is to SOHO/small business deployments where default credentials may still be in use.

An attacker who has obtained valid credentials to the Tenda F456 router's web management interface (through credential stuffing, default passwords, or prior compromise) connects to the device remotely and sends a specially crafted HTTP POST request to /goform/NatStaticSetting with an oversized 'page' parameter value exceeding the stack buffer size. The fromNatStaticSetting function copies this unchecked input, overwriting the stack return address and redirecting execution to attacker-controlled shellcode, achieving remote code execution with root privileges on the router. The attacker can then establish persistence, pivot to internal network segments, or modify router firmware.