Tenda F453 CVE-2026-6989

Exploitation requires authenticated access to the device with low-privilege credentials (PR:L per CVSS vector). The attacker must either possess valid login credentials or exploit another mechanism to obtain them (such as default credentials if unchanged, or a separate authentication bypass). The /goform/telnet endpoint must be accessible on the network - if restricted by firewall rules, the attack surface is reduced. No special device configuration is documented as required; the vulnerable function appears present in default firmware. Non-default configurations or network isolation can limit exposure, but any device reachable by a user with valid credentials is exploitable.

CVSS 6.3 with network vector (AV:N) and low complexity (AC:L) indicates broad accessibility, but authentication requirement (PR:L) limits scope to users with valid credentials or those who can obtain them. EPSS vector presence (E:P) suggests proof-of-concept availability increases real-world exploitation likelihood. The public disclosure of exploit code combined with the straightforward nature of command injection against a telnet service creates significant practical risk. However, the low-privilege authentication barrier provides some protection compared to unauthenticated RCE. Real-world risk depends heavily on whether default credentials exist or are commonly used in deployed Tenda F453 devices - this critical factor is not addressed in provided data. The command injection against a telnet endpoint means successful exploitation likely grants arbitrary command execution at the service process privilege level, which may be root on many IoT router deployments.

An attacker with valid router credentials (obtained via default credentials, credential compromise, or guest account if available) authenticates to the Tenda F453 web interface and sends a crafted request to /goform/telnet with injected shell metacharacters in a command parameter. The vulnerable TendaTelnet function fails to sanitize the input and passes the attacker-controlled string directly to a system shell execution function, allowing the attacker to execute arbitrary commands such as creating new admin accounts, exfiltrating configuration data, or installing persistent backdoors.