Tenda F456 CVE-2026-7033

Requires authenticated access to the Tenda F456 router's web management interface with low-privilege user credentials (CVSS PR:L). The SafeClientFilter feature, accessed via /goform/SafeClientFilter, must be reachable - this endpoint is part of the standard web management interface and is present in default configurations. Exploitation is possible from any network location that can reach the management interface: typically LAN by default, but also WAN if remote administration is enabled in router settings. No user interaction required (UI:N). Limiting factors include: management interface must be accessible to attacker (firewall rules, network segmentation may block access), valid credentials required (default admin credentials 'admin/admin' or similar often unchanged on SOHO routers), and exploit success may depend on firmware build specifics like ASLR/DEP support (unlikely on this class of device but not confirmed absent).

Real-world risk is MODERATE-HIGH for exposed devices. The CVSS 4.0 score of 7.4 with vector AV:N/AC:L/PR:L indicates network-exploitable with low complexity but requires low-privilege authentication. The E:P (Proof-of-Concept) metric confirms public exploit code exists on GitHub, significantly lowering the skill barrier for exploitation. However, the PR:L requirement means attackers need valid router credentials, which reduces exploitability compared to unauthenticated RCE. The VC:H/VI:H/VA:H impact ratings show complete device compromise is possible. Key limiting factor: exploitation requires access to the router's management interface, typically restricted to LAN by default but often exposed via weak passwords, default credentials, or WAN admin access misconfiguration. No EPSS or KEV data provided, but buffer overflows in SOHO routers with public POCs historically see exploitation within weeks of disclosure. Prioritize if Tenda F456 devices are deployed with management interfaces accessible from untrusted networks or if default/weak credentials are in use.

An attacker on the same network as the Tenda F456 router (or with internet access if WAN administration is enabled) obtains low-privilege credentials through password guessing, default credential reuse, or prior compromise. Using the publicly available exploit code from GitHub, the attacker crafts a malicious HTTP POST request to /goform/SafeClientFilter with oversized 'menufacturer' or 'Go' parameter values that overflow the buffer in fromSafeClientFilter function. This overwrites return addresses or function pointers, redirecting execution to attacker-controlled shellcode that executes with the privileges of the web server process (typically root on embedded devices), granting complete control over the router including traffic interception, DNS hijacking, and lateral movement into the internal network.