Tenda EUVD-2026-16981

Authenticated user access to Tenda 4G06 firmware version 04.06.01.29. Attacker must send a crafted request to /goform/DhcpListClient endpoint with manipulated 'page' parameter. No victim interaction required. Remote exploitation via HTTP/HTTPS.

Real-world risk is elevated despite the authentication requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low attack complexity requiring only low-privilege credentials-often default or weak passwords on consumer routers. The 8.8 score reflects complete compromise potential (C:H/I:H/A:H). The existence of publicly available exploit code (GitHub PoC) dramatically increases risk by enabling script-kiddie level attacks. However, the PR:L requirement means attackers need valid credentials first, typically obtained through credential stuffing, default password exploitation, or social engineering. No CISA KEV listing suggests this is not yet mass-exploited in the wild, but the public PoC creates immediate risk for organizations using affected devices. SSVC factors indicate high technical impact (total system compromise possible) with confirmed PoC existence. Automated exploitation is feasible once authentication is bypassed. For internet-exposed Tenda 4G06 devices with default/weak credentials, this represents a critical pathway to network infiltration. The lack of available patch information substantially increases risk duration.

An attacker conducts reconnaissance scanning for internet-exposed Tenda 4G06 routers on common management ports (HTTP/443, 80). After identifying a target device, the attacker attempts authentication using default credentials (admin/admin) or credentials obtained from previous breaches. Once authenticated with low-privilege access, the attacker crafts a malicious HTTP request to the /goform/DhcpListClient endpoint with an oversized 'page' parameter value designed to overflow the stack buffer. The crafted payload overwrites the return address on the stack to redirect execution to attacker-controlled shellcode, granting complete control over the router. From this position, the attacker can intercept network traffic, modify DNS responses to redirect users to phishing sites, establish persistent backdoor access, or pivot into the internal network to compromise additional systems. The publicly available PoC code at GitHub provides ready-made exploitation tools, requiring minimal technical sophistication to execute this attack chain.