Tenda F456 CVE-2026-7031

Exploitation requires valid administrative credentials to the Tenda F456 web management interface. The CVSS vector PR:L (low privileges required) indicates authentication is mandatory - this is NOT an unauthenticated vulnerability. Specific conditions include: (1) Network connectivity to the router's web interface (typically TCP port 80 or 8080), which must be accessible from the attacker's position (LAN or WAN if remote management is enabled). (2) Knowledge of or ability to guess/crack administrative credentials - Tenda devices commonly ship with 'admin/admin' default credentials that many users never change. (3) The vulnerable firmware version 1.0.0.5 must be installed. The attack targets the MAC address filtering configuration feature, but this feature does NOT need to be actively enabled - the vulnerable code path in fromSafeMacFilter is accessible regardless of whether MAC filtering is configured. What LIMITS exploitation: The authentication requirement significantly reduces opportunistic mass exploitation compared to unauthenticated RCE vulnerabilities. Attackers must first compromise credentials through default password scanning, credential stuffing, phishing, or prior access. Remote exploitation also requires the web interface to be exposed beyond the local network, which is non-default on most consumer routers but common in misconfigured deployments.

Real-world risk is MODERATE-TO-HIGH for existing deployments but LIMITED in scope. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity but requiring authentication - attackers need valid credentials (default, weak, or compromised). The E:P metric confirms proof-of-concept exploit exists and is publicly available on GitHub, meaning skilled attackers can weaponize this with minimal effort. However, no CISA KEV listing suggests this is not being actively exploited in the wild at scale. EPSS data is unavailable in the provided intelligence. The authentication requirement (PR:L) significantly reduces attack surface compared to unauthenticated vulnerabilities, but Tenda routers are notorious for weak default credentials ('admin/admin'), which effectively lowers this barrier. The complete impact scope (VC:H/VI:H/VA:H) means successful exploitation grants full control over the router, enabling network traffic interception, DNS hijacking, or pivot points for lateral movement. Priority depends on deployment context: consumer home networks face lower risk (requires credential compromise first), but small business environments with unchanged default passwords face elevated risk. The lack of scope change (SC:N/SI:N/SA:N) means impact is contained to the router itself, not the broader network infrastructure.

An attacker on the internet discovers a Tenda F456 router with default credentials still active (admin/admin) through automated scanning of port 80/8080. After authenticating to the web interface, the attacker sends a specially crafted HTTP POST request to /goform/SafeMacFilter with an oversized 'page' parameter value, triggering the buffer overflow in the fromSafeMacFilter function. This corrupts adjacent memory regions, allowing the attacker to hijack execution flow and inject shellcode that executes with the privileges of the web server process (typically root on embedded devices). With code execution achieved, the attacker installs persistent backdoor firmware, modifies DNS settings to redirect traffic through attacker-controlled servers, or uses the compromised router as a command-and-control node for botnet operations. The public GitHub POC at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_121/README.md provides the technical details needed to reproduce this attack.