Tenda F456 CVE-2026-7054

Attacker must successfully authenticate to the Tenda F456 web administrative interface using valid credentials, as indicated by CVSS vector component PR:L (low privileges required). The router's httpd web server must be network-accessible to the attacker - either exposed to the internet via remote administration features or accessible from a compromised device on the local network. The PPTP client configuration functionality must be present and accessible through the /goform/PPTPDClient endpoint, which is part of the default firmware installation. No special non-default configuration is required beyond network reachability and credential access. Attack complexity is low (AC:L) with no user interaction needed (UI:N), meaning exploitation is straightforward once authentication is achieved. The primary limiting factor is the authentication requirement - if default credentials have been changed to strong passwords and remote admin is disabled, exploitation requires prior compromise of credentials or LAN access.

Real-world risk is MODERATE TO HIGH for internet-exposed devices with weak credentials. CVSS 7.4 (High) reflects the severity of remote code execution with high confidentiality, integrity, and availability impact. The CVSS vector shows PR:L (low privileges required), meaning an attacker needs authentication to the router's administrative interface - a significant hurdle but not insurmountable given widespread credential reuse and default password issues in consumer networking equipment. The Exploit Maturity indicator (E:P) confirms proof-of-concept code is publicly available on GitHub, which dramatically increases real-world exploitability. No EPSS score is provided, but the combination of public exploit + authentication requirement suggests moderate exploitation probability - lower than unauthenticated RCE but higher than vulnerabilities requiring complex attack chains. Not present in CISA KEV, indicating no confirmed widespread exploitation campaigns yet. SSVC assessment: exploitation is PROVEN (public POC exists), automatable is LIKELY (authenticated web requests can be scripted), technical impact is TOTAL (RCE with device compromise). Priority depends on exposure - critical for internet-facing devices, lower for LAN-only management interfaces. Key uncertainty: exact exploit reliability and whether default credentials are known for this model, which would eliminate the authentication barrier in practice.

An attacker scans the internet for Tenda F456 routers with exposed web management interfaces on common ports (80, 8080, 443). Using credential stuffing attacks or default password lists, they authenticate to the administrative panel. The attacker then sends a crafted HTTP POST request to /goform/PPTPDClient with oversized opttype or usernamewith parameters designed to overflow the buffer in fromPptpUserAdd. This triggers code execution with the privileges of the httpd process (likely root), allowing installation of persistent backdoors, DNS hijacking for man-in-the-middle attacks, or pivoting into the internal network.