Tenda F456 EUVD-2026-25708

Exploitation requires the attacker to possess valid low-privilege administrative credentials for the Tenda F456 web management interface, as indicated by the PR:L (Privileges Required: Low) CVSS metric. The vulnerable SafeEmailFilter function must be accessible via the /goform/SafeEmailFilter endpoint, which is part of the standard web management interface in firmware version 1.0.0.5. No non-default configuration or special feature enablement is required beyond the standard router management interface being active. Attack complexity is low (AC:L) indicating reliable exploitation once authentication is achieved. The network attack vector (AV:N) means the vulnerability can be exploited remotely if the web management interface is accessible from the attacker's network position, which depends on whether WAN-side remote management is enabled or if the attacker has already compromised a device on the LAN segment.

Real-world risk assessment shows moderate-to-high concern despite the 7.4 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity, but requires low-privilege authentication, which substantially reduces the attack surface compared to unauthenticated vulnerabilities. The public exploit availability (GitHub POC) is the most significant risk multiplier, as it enables script-kiddie level attacks against organizations that reuse default credentials or have weak router authentication. However, the absence of CISA KEV listing and the vulnerability being reported through VulDB rather than active incident response suggests this is not yet seeing widespread exploitation. The complete system impact (VC:H/VI:H/VA:H) means successful exploitation grants full router control, enabling network pivoting, traffic interception, and persistent access. Primary risk is to small office/home office environments and organizations using Tenda equipment in network edge deployments where credential hygiene may be weak. Enterprise networks typically don't deploy Tenda consumer-grade equipment, naturally limiting exposure.

An attacker on the internet scans for Tenda F456 routers with exposed web management interfaces using Shodan or similar reconnaissance tools. After identifying a target, the attacker attempts credential stuffing or brute-force attacks against common default credentials to obtain low-privilege administrative access. Once authenticated, the attacker sends a specially crafted HTTP request to the /goform/SafeEmailFilter endpoint with a malicious 'page' parameter containing shellcode exceeding the buffer boundary. The buffer overflow overwrites the return address, redirecting execution to attacker-controlled code running with router system privileges, granting full device control for network traffic interception, firmware modification, or pivoting into the internal network.