F456 CVE-2026-6200

Requires authenticated access to the Tenda F456 router's web management interface, specifically valid credentials with administrative privileges (CVSS PR:L). The vulnerable /goform/webtypelibrary endpoint is part of the standard web UI functionality and is accessible when web management is enabled, which is the default configuration. No additional feature enablement or non-standard deployment mode is required beyond the attacker possessing valid login credentials. Authentication can be bypassed if default credentials have not been changed, which is common in SOHO router deployments.

Real-world risk assessment reveals moderate-to-low immediate threat despite the 7.4 CVSS score. The CVSS:4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity but requires authenticated access to the router's web interface, significantly constraining the attack surface to scenarios where an attacker has already obtained valid credentials (default credentials, credential stuffing, or insider threat). The E:P (Proof-of-concept) metric confirms public exploit availability, validated by the GitHub repository reference. However, EPSS score of 0.05% (14th percentile) suggests extremely low probability of active exploitation in the wild, likely due to the authentication barrier and limited deployment footprint of this specific router model. No CISA KEV listing indicates no confirmed active exploitation campaigns. SSVC assessment: exploitation status is POC-level, automatable after authentication, technical impact is total system compromise of the router. Priority depends heavily on whether organizations use Tenda F456 routers in production environments-most enterprise networks do not deploy this consumer-grade hardware, limiting organizational risk. The primary risk population is small office/home office (SOHO) deployments where default credentials are common.

An attacker who has obtained valid credentials to the Tenda F456 router's web interface (either through default credentials, previous compromise, or social engineering) connects to the device over the network. They send a specially crafted HTTP POST request to the /goform/webtypelibrary endpoint with an oversized malicious payload in the 'menufacturer' or 'Go' parameter, triggering the stack-based buffer overflow in the formwebtypelibrary function. The overflow overwrites the stack return address, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access, modifies firewall rules, intercepts network traffic, or pivots into the internal network behind the router.