Tenda F456 CVE-2026-7099

Requires valid low-privilege authentication to the Tenda F456 web management interface (httpd service on TCP port 80 or 443). The CVSS vector PR:L indicates exploitation demands authenticated access, meaning attackers must possess or obtain router admin credentials before triggering the buffer overflow. Attack succeeds against default configurations of Tenda F456 firmware 1.0.0.5 with the QuickIndex functionality enabled (standard in shipped firmware). Limiting factors: Authentication barrier eliminates drive-by internet exploitation unless default credentials remain unchanged or management interface is unnecessarily exposed to WAN. Attack complexity is low (AC:L) once authentication is obtained - no race conditions, timing requirements, or complex protocol interactions needed. The AV:N network vector confirms remote exploitation without physical access to the device.

Real-world risk is MODERATE despite the 7.4 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity but requires low-privilege authentication, meaning attackers need valid credentials to the router's web interface. Public exploit code on GitHub significantly lowers the skill barrier for exploitation. However, the PR:L requirement substantially limits attack surface compared to unauthenticated vulnerabilities - attackers typically need to first compromise default/weak credentials or chain with an authentication bypass. The E:P (Proof-of-concept) metric confirms weaponized code exists. No EPSS score or KEV status provided in input data, but the combination of public exploit + authenticated network access suggests targeted attacks against poorly secured routers (default credentials, exposed management interfaces) are realistic. Priority should focus on internet-facing Tenda F456 deployments with default credentials or publicly accessible admin panels. Defense depends heavily on authentication hygiene and network segmentation.

An attacker on the internet identifies a Tenda F456 router with exposed web management interface on port 80/443 through Shodan or similar scanning. Using default credentials (admin/admin) or previously compromised credentials from credential stuffing attacks, the attacker authenticates to the web interface. They then send a specially crafted HTTP POST request to /goform/QuickIndex with an oversized mit_linktype parameter value exceeding buffer limits, triggering the overflow in formQuickIndex function. The public GitHub exploit code provides ready-to-use payloads for reliable exploitation. Successful overflow overwrites return addresses or function pointers, redirecting execution to attacker-controlled shellcode, granting root-level access to the router firmware for persistent backdoor installation or network traffic interception.