F456 CVE-2026-6199

Valid administrative credentials to the Tenda F456 web management interface are required (CVSS PR:L indicates low-privileged authenticated access). The /goform/qossetting endpoint must be reachable from the attacker's network position, which typically requires either LAN access or enabled remote management features if attacking from WAN. No specific non-default configuration is required beyond the vulnerable firmware version 1.0.0.5 being installed-the fromqossetting function processes the 'page' parameter during normal QoS configuration operations, making this exploitable in default router deployments once authentication is achieved.

Real-world risk is MODERATE despite the High CVSS score of 7.4. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity but requires authenticated access (PR:L), which significantly reduces the attack surface compared to unauthenticated vulnerabilities. EPSS score of 0.05% (14th percentile) suggests very low probability of mass exploitation in the wild-threat actors are not widely targeting this specific vulnerability. The SSVC framework assessment confirms 'poc' exploitation status (proof-of-concept exists but no active exploitation), 'automatable: no' (cannot be mass-scanned due to auth requirement), and 'total' technical impact (full device compromise possible). The GitHub POC demonstrates exploitability, making this a viable target for opportunistic attackers who have already compromised admin credentials via phishing, credential stuffing, or default password usage. Priority should be HIGH for organizations using Tenda F456 routers in production environments, but MEDIUM for home users who maintain unique admin passwords. The key risk factor is that once authenticated, exploitation complexity is low and leads to complete device takeover, enabling network pivoting, traffic interception, and persistent backdoor installation.

An attacker who has obtained valid administrative credentials for a Tenda F456 router (through credential stuffing, default password usage, or prior phishing) authenticates to the web management interface and navigates to the QoS settings page at /goform/qossetting. They craft a malicious HTTP request with an oversized 'page' parameter value designed to overflow the stack buffer in the fromqossetting function, injecting shellcode that executes with root privileges. The buffer overflow overwrites the return address on the stack, redirecting execution to attacker-controlled code that establishes a reverse shell, installs persistent backdoor firmware, or reconfigures the router to intercept and exfiltrate network traffic. The publicly available GitHub POC (https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_116/README.md) provides ready-to-use exploit code lowering the skill barrier for exploitation.