Tenda F456 CVE-2026-7098

Exploitation requires network access to the Tenda F456 web management interface (typically TCP port 80 or 8080) and valid low-privilege HTTP authentication credentials (PR:L). The vulnerability affects the DHCP client list functionality accessed via /goform/DhcpListClient endpoint, which is a standard feature enabled by default in the web interface. No special router configuration beyond having the web management interface enabled is required - this is the default state for Tenda F456 routers. The primary limiting factor is authentication: while default credentials are commonly unchanged on consumer routers, credential compromise via brute force, credential stuffing, or social engineering is a prerequisite. Routers with management interfaces exposed to the internet face significantly higher risk than those restricted to LAN-only access. No user interaction is required once authentication is achieved (UI:N).

Real-world risk is HIGH for internet-exposed Tenda F456 routers with accessible management interfaces. The CVSS 4.0 base score of 7.4 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L). The E:P modifier confirms proof-of-concept exploit code exists and is publicly available on GitHub, significantly lowering the barrier to exploitation. While authentication is required (PR:L), SOHO routers frequently have default credentials unchanged or weak passwords susceptible to brute force, effectively reducing the authentication barrier in real-world deployments. The scope is unchanged (SC:N/SI:N/SA:N), meaning compromise is limited to the vulnerable router itself, but full device compromise enables network traffic interception, DNS hijacking, and pivot attacks against internal networks. The absence of EPSS scoring and CISA KEV listing suggests exploitation is not yet widespread, but the combination of public POC, remote attack vector, and common deployment of Tenda routers in home/small business environments creates a realistic threat window. Priority should be MEDIUM-HIGH for organizations using these devices, CRITICAL if management interfaces are internet-accessible.

An attacker performs network reconnaissance and identifies a Tenda F456 router with firmware 1.0.0.5 via banner grabbing on the web interface. Using default credentials ('admin'/'admin') or credentials obtained via password spraying, the attacker authenticates to the web management interface. The attacker then sends a crafted HTTP POST request to /goform/DhcpListClient with an oversized 'page' parameter containing shellcode. The buffer overflow overwrites the stack return address, hijacking execution flow to attacker-controlled code that executes with httpd process privileges, typically root on embedded Linux routers. The attacker establishes persistence via modified firmware or startup scripts, enabling long-term network surveillance, DNS redirection to phishing sites, or use of the router as a bot in a larger botnet campaign.