Tenda F456 EUVD-2026-25705

Exploitation requires authenticated access to the Tenda F456 web management interface - specifically low-privilege credentials (CVSS PR:L), meaning standard user-level access rather than administrative privileges. The vulnerable /goform/RouteStatic endpoint must be network-accessible to the attacker, which typically requires either internet-facing management interface exposure (common in misconfigured SOHO routers) or attacker presence on the local network segment. Default Tenda router configurations often expose the web interface on WAN interfaces and ship with well-known default credentials (admin/admin), making credential acquisition trivial for internet-facing devices. For devices with changed credentials and LAN-only management, exploitation is limited to attackers who have already compromised the internal network or have physical proximity for wireless access. No special firmware configuration, non-default features, or specific deployment modes are required - the vulnerable function appears to be present in standard router operation. The buffer overflow is triggered by manipulating the 'page' argument, requiring only the ability to send crafted HTTP POST requests to the endpoint, which the CVSS AC:L (Low complexity) rating confirms as straightforward.

Real-world risk is MODERATE to HIGH for deployed Tenda F456 routers, though actual exploitation likelihood depends heavily on network exposure. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity, but requires authenticated access (PR:L), which substantially reduces attack surface compared to unauthenticated vulnerabilities. The publicly available POC on GitHub (referenced in exploit links) dramatically lowers exploitation barriers, enabling even moderately skilled attackers to weaponize this vulnerability. However, no CISA KEV listing suggests this is not yet experiencing widespread active exploitation in the wild. EPSS data is not provided, limiting probability assessment. The CVSS environmental metrics show E:P (Proof-of-concept exists), confirming exploit maturity. Critical assessment factor: authentication requirement means attackers need valid credentials first - exploitation requires either credential compromise through default/weak passwords (common in SOHO routers), credential stuffing, or chaining with an authentication bypass vulnerability. For internet-facing routers with default credentials, risk escalates to CRITICAL. For routers behind NAT with changed credentials, risk is MODERATE assuming no other LAN-based threats.

An attacker scans internet-facing Tenda F456 routers and identifies devices with default or weak administrative credentials through credential stuffing or brute force attacks. After authenticating to the web management interface with low-privilege credentials (often 'admin:admin' on default configurations), the attacker crafts a malicious HTTP request to /goform/RouteStatic with an oversized 'page' parameter value designed to overflow the buffer. The POC code from the GitHub repository (https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_120/README.md) demonstrates the exact payload structure required. Successful exploitation overwrites memory regions, allowing the attacker to execute arbitrary code with root/administrator privileges on the router, establishing persistent backdoor access to monitor traffic, pivot into the internal network, or recruit the device into a botnet.