Tenda F456 CVE-2026-7078

Exploitation requires authenticated access to the Tenda F456 web management interface, specifically low-privilege credentials (PR:L per CVSS vector). The /goform/SetIpBind endpoint must be accessible, which is the default configuration when the httpd web server is enabled. No special features or non-default settings are required beyond standard router web UI availability. Key limiting factors: (1) Attacker must obtain valid credentials, though Tenda routers commonly ship with default credentials that users rarely change in SOHO deployments. (2) Network accessibility to the management interface - exploitation is remote (AV:N) but requires either internet-exposed admin panel or existing LAN access. (3) Firmware version must be exactly 1.0.0.5 per confirmed vulnerable CPE; other versions not validated. (4) No user interaction required (UI:N), making exploitation scriptable once credentials are obtained.

Real-world exploitation risk is elevated due to the convergence of multiple threat signals. The CVSS 4.0 base score of 7.4 reflects network attack vector (AV:N), low complexity (AC:L), and high CIA impact, though scoped to the vulnerable component only (SC:N/SI:N/SA:N). Critically, public exploit code exists (E:P confirmed via GitHub repository), significantly lowering the barrier for opportunistic attacks against exposed devices. The PR:L requirement means attackers need low-privilege credentials, which on consumer routers often means default credentials ('admin/admin') that remain unchanged in many deployments. The combination of public POC, network accessibility, and likely credential reuse in home/SOHO environments creates actionable risk. However, scope limitation (S:N equivalent in CVSS v4) suggests exploitation remains contained to the router itself rather than enabling lateral movement. No CISA KEV listing indicates this is not yet observed in widespread campaigns, likely due to the limited deployment footprint of this specific Tenda model/version. EPSS data absent - cannot quantify probability scoring. Prioritize patching for internet-facing Tenda F456 devices, especially in environments with default credentials.

An attacker identifies Tenda F456 routers exposed on the internet via Shodan or similar scanning, targeting devices with default credentials (admin/admin). After successful authentication with low privileges, the attacker sends a crafted HTTP POST request to /goform/SetIpBind with an oversized 'page' parameter value exceeding buffer capacity. The fromSetIpBind function fails to validate input length, triggering a buffer overflow that overwrites return addresses or function pointers. The attacker leverages publicly available POC code from GitHub (Litengzheng/vuldb_new/F456/vul_129) to achieve arbitrary code execution as the httpd process (likely root privileges on embedded systems), enabling complete device compromise including firmware modification, traffic interception, or pivot point for internal network attacks.