F456 EUVD-2026-22057

Exploitation requires valid administrative credentials for the Tenda F456 router web interface. The attack targets the wireless security configuration function (formWrlsafeset in /goform/AdvSetWrlsafeset endpoint), which is accessible only to authenticated users with router management privileges. Network access to the router's HTTP/HTTPS management ports (typically TCP 80 or 443) is required, whether from the LAN side or if remote administration is enabled on the WAN interface.

Real-world risk assessment reveals moderate concern despite the 7.4 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity but requires authenticated access (PR:L), significantly raising the barrier compared to unauthenticated vulnerabilities. SSVC framework rates this as 'poc' exploitation status (publicly available proof-of-concept), 'no' for automatable (requires authentication credentials), and 'total' technical impact (complete device compromise possible). The 0.05% EPSS score places this in the 14th percentile, suggesting security researchers assess real-world exploitation likelihood as very low despite POC availability. This discrepancy exists because router credentials are often default or weak, but attackers typically target routers through unauthenticated vectors for mass exploitation. The requirement for valid credentials makes this more relevant for targeted attacks against specific installations rather than opportunistic scanning campaigns. No CISA KEV listing confirms this remains a theoretical rather than actively exploited threat. Priority should be moderate: patch when feasible, but this is not an emergency comparable to unauthenticated RCE vulnerabilities.

An attacker who has obtained valid administrative credentials for a Tenda F456 router (through credential stuffing, default password exploitation, or social engineering) connects to the web management interface remotely. They navigate to the wireless security settings page and submit a specially crafted HTTP POST request to /goform/AdvSetWrlsafeset containing an oversized 'mit_ssid' parameter designed to overflow the stack buffer. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access and pivots into the internal network.