Tenda F456 CVE-2026-7081

Requires low-privileged authenticated access to the Tenda F456 web administration interface at /goform/GstDhcpSetSer endpoint. The CVSS vector PR:L indicates authentication is required, but Tenda routers commonly ship with well-known default credentials (admin/admin) that users frequently fail to change, effectively reducing this barrier in real-world deployments. Network access (AV:N) to the router's HTTP/HTTPS management interface is required-this may be LAN-only in secure configurations but is often exposed to the internet in default installations where remote management features are enabled. No other special configuration, non-default features, or user interaction (UI:N) is required beyond basic router operation. Attack complexity is low (AC:L) with no additional timing or environmental requirements (AT:N). The vulnerability exists in default product configuration targeting the DHCP server settings handler, a standard administrative function accessible to any authenticated user.

Real-world risk is HIGH for deployed Tenda F456 routers but limited in scope. CVSS 7.4 (High) accurately reflects the technical severity with network attack vector (AV:N), low complexity (AC:L), and full impact on device confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The requirement for low-privileged authentication (PR:L) provides minimal protection since Tenda routers often ship with default credentials (admin/admin) that remain unchanged in many deployments, effectively reducing the authentication barrier. The CVSS 4.0 Exploit Maturity indicator (E:P for Proof-of-Concept) is confirmed by the public GitHub repository containing exploit details. However, this CVE targets a consumer-grade router with limited enterprise deployment, reducing overall exposure compared to widely-deployed enterprise infrastructure. No EPSS score is provided, preventing quantitative exploitation probability assessment. Absence from CISA KEV suggests no confirmed widespread exploitation campaigns at time of analysis, though the public POC increases this risk. The scope metric (SC:N/SI:N/SA:N) indicates no privilege escalation beyond the compromised router itself. Priority should be MEDIUM-HIGH for organizations using Tenda F456 routers, CRITICAL if internet-facing with default credentials.

An attacker on the same network as the Tenda F456 router (or with internet access if remote management is enabled) authenticates to the web interface using default credentials admin/admin. They send a specially-crafted HTTP POST request to /goform/GstDhcpSetSer with an oversized 'dips' parameter containing shellcode, triggering a buffer overflow in the fromGstDhcpSetSer function. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled code that runs with root privileges in the httpd process, allowing them to modify firewall rules, intercept DNS queries, establish persistent backdoor access, or pivot to other network devices. Public proof-of-concept code demonstrating this attack is available at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_133/README.md.