Tenda F456 CVE-2026-7019

Network-accessible Tenda F456 router with firmware version 1.0.0.5 and authenticated access to the web management interface. Attacker must obtain valid low-privilege credentials (PR:L) - exploitation possible with default credentials, guest accounts, or compromised user credentials. The /goform/P2pListFilter endpoint must be accessible, which is the default configuration in Tenda F456 routers. No special feature enablement or non-default configuration required beyond standard web management interface availability. Exploitation is limited by the authentication requirement (not remotely exploitable without credentials) and network accessibility to the management interface (WAN exposure, LAN access, or compromised internal network position).

CVSS 7.4 indicates High severity with complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) and no cross-scope impact (SC:N/SI:N/SA:N). The attack vector is network-based with low complexity and requires low-privilege authentication (AV:N/AC:L/PR:L/UI:N), meaning any authenticated user can exploit this remotely without specialized skills or user interaction. The CVSS Exploit Maturity indicator (E:P) confirms publicly available proof-of-concept code exists, referenced in the GitHub repository link. This significantly increases real-world risk as script kiddies can exploit the vulnerability without developing original exploits. However, the PR:L requirement limits exposure to scenarios where attackers have obtained credentials (default credentials, phishing, or credential stuffing). No CISA KEV listing suggests exploitation is not yet widespread in the wild. EPSS score not provided, preventing quantitative exploitation probability assessment. The primary risk is to organizations using Tenda F456 routers with exposed management interfaces or weak authentication. Home users with default credentials face elevated risk. Without patch availability confirmation from Tenda and public exploit availability, this represents a tactical priority for defenders with affected devices, though not strategic-level urgency absent active exploitation campaigns.

An attacker scans for Tenda F456 routers with exposed web management interfaces on default ports 80/443. Using credential stuffing with known default Tenda credentials (admin/admin) or previously compromised credentials, the attacker authenticates to the router's web interface. The attacker sends a crafted HTTP POST request to /goform/P2pListFilter with an oversized 'menufacturer' or 'Go' parameter value exceeding buffer limits. The fromP2pListFilter function copies the malicious input without bounds checking, overwriting stack memory and hijacking execution flow to attacker-controlled shellcode. Successful exploitation grants the attacker root-level code execution on the router's embedded Linux system, enabling network traffic interception, DNS hijacking for phishing, botnet enrollment, or pivot point for attacking internal network devices.