Tenda F456 CVE-2026-7079

Exploitation requires authenticated access to the Tenda F456 web management interface (PR:L indicates low-privilege authentication required). Specifically, the attacker must possess valid administrative credentials for the router-often the factory default 'admin/admin' on Tenda devices if unchanged by the user. The vulnerability is exploitable when the Advanced WAN Settings configuration page (/goform/AdvSetWan) is accessible, which is a standard feature enabled by default in firmware 1.0.0.5. Attack complexity is low (AC:L) with no additional timing constraints (AT:N) or user interaction required (UI:N), meaning exploitation succeeds deterministically once authenticated. Limiting factors: Network access to the management interface is required (typically TCP port 80/443 on LAN-side IP, or WAN-side if remote management enabled), and many security-conscious users disable WAN-side management or change default credentials, significantly reducing the attack surface. The vulnerability does not require any non-default configuration-all installations of firmware 1.0.0.5 with default WAN configuration features enabled are vulnerable.

This vulnerability presents HIGH real-world risk despite requiring authentication (PR:L). The CVSS 4.0 score of 7.4 with vector AV:N/AC:L/PR:L indicates network-exploitable with low attack complexity requiring only low-privilege credentials. Critically, the CVSS vector shows E:P (Proof-of-concept exploit exists), confirmed by the GitHub repository containing working exploit code. Many Tenda routers ship with default credentials or weak passwords, effectively lowering the authentication barrier. The high impact ratings (VC:H/VI:H/VA:H) indicate complete compromise of confidentiality, integrity, and availability of the device. However, scope remains unchanged (SC:N/SI:N/SA:N), meaning exploitation is contained to the router itself without lateral movement capabilities encoded in the CVSS. Real-world risk factors favoring exploitation: publicly documented POC, common target (consumer router), likely deployment with default credentials, and management interfaces often exposed to WAN or LAN networks. Risk-limiting factors: requires initial authentication and affects only a specific older firmware version (1.0.0.5). No CISA KEV listing suggests this is not yet widely exploited in campaigns, but the public POC availability makes opportunistic exploitation likely. Organizations should prioritize remediation for internet-facing or IoT-segmented deployments of this specific model and firmware.

An attacker on the same network as the Tenda F456 router (or with internet access if remote management is enabled) first authenticates using default credentials ('admin/admin') or credentials obtained through credential stuffing attacks against the web interface. After authentication, the attacker sends a crafted HTTP POST request to the /goform/AdvSetWan endpoint with an oversized wanmode parameter (e.g., 512+ bytes of shellcode prepended with NOP sled), triggering the buffer overflow in the fromAdvSetWan function. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that spawns a reverse shell with root privileges, granting complete control over the router's operating system, network traffic routing, DNS settings, and connected devices. Public POC code from GitHub (Litengzheng/vuldb_new) significantly lowers the skill barrier for this attack.