Tenda F456 CVE-2026-7101

Low-privilege authentication to the Tenda F456 web management interface is required (CVSS PR:L). The attacker must have valid credentials for the router's administrative or user account capable of accessing the /goform/WrlclientSet endpoint. No user interaction is required (UI:N) once authenticated. Attack complexity is low (AC:L/AT:N), indicating no special timing, race conditions, or environmental factors are needed. This is not remote unauthenticated exploitation - the PR:L requirement is a meaningful barrier. Exploitation is limited by: (1) need for network access to the router's web interface (typically LAN access or if remote management is enabled), (2) valid authentication credentials, and (3) the wireless client configuration feature being accessible to the authenticated user role. Default or weak credentials would significantly lower this barrier in practice.

Real-world risk is MODERATE-HIGH despite the 7.4 CVSS score. The CVSS 4.0 vector shows network attack vector with low complexity (AV:N/AC:L/AT:N), but exploitation requires low-privilege authentication (PR:L), which limits immediate attack surface to users with valid router credentials. The E:P (Proof-of-concept) metric confirms publicly available exploit code exists on GitHub, significantly lowering the skill threshold for exploitation. High impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) indicates complete device compromise is possible. Scope is unchanged (SC:N/SI:N/SA:N), meaning impact is contained to the vulnerable router itself. The PR:L requirement is a key limiting factor - attackers need router credentials first, suggesting this may be used in attack chains following credential compromise or as a post-authentication privilege escalation. Without EPSS data, we cannot assess widespread exploitation probability, but home router vulnerabilities are frequently targeted by botnet campaigns. CISA KEV status is not provided; if not listed, this suggests targeted rather than mass exploitation to date. Priority depends heavily on whether default/weak credentials are common on Tenda F456 devices, which would effectively reduce the PR:L barrier.

An attacker who has obtained valid low-privilege router credentials (through credential stuffing, default password exploitation, or network sniffing) sends a specially crafted HTTP request to the /goform/WrlclientSet endpoint. The malicious payload contains oversized input parameters that trigger the buffer overflow in the fromWrlclientSet function, overwriting memory to redirect execution flow to attacker-controlled code. The attacker gains full root-level control of the router, enabling deployment of persistent backdoors, traffic interception, DNS hijacking for phishing campaigns, or integration into a botnet. Public proof-of-concept code at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_139/README.md provides exploitation details, making this attack accessible to low-skill adversaries.