Tenda F456 EUVD-2026-25723

Exploitation requires low-privilege authenticated access to the Tenda F456 web administration interface, typically obtained via default credentials (many Tenda devices ship with admin/admin), weak user-set passwords, or credential reuse from other breaches. The vulnerability is present when the router's httpd service is network-accessible-this includes the default configuration where LAN-side management is enabled on TCP port 80, and critically, if WAN-side remote management has been enabled by the user (disabled by default on most units but commonly enabled in SOHO/small business deployments for convenience). No special Layer 7 protocol filtering configuration is required; the vulnerable frmL7ProtForm function is reachable whenever the /goform/L7Prot endpoint processes requests. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation proceeds entirely through automated HTTP requests without requiring victim actions beyond having the management interface enabled. The primary limiting factor is the authentication requirement (PR:L), though this barrier is substantially weakened by widespread default credential usage in consumer router deployments.

Real-world risk is elevated due to convergence of multiple exploitation-favorable signals. CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity requiring only low-privilege authentication-many Tenda routers ship with default credentials or weak password policies, effectively lowering the PR:L barrier. The E:P (Proof-of-concept) modifier confirms publicly available exploit code on GitHub, drastically reducing attacker skill requirements. However, no EPSS score is provided and CISA KEV status is absent, suggesting exploitation remains proof-of-concept rather than widespread automated attacks as of analysis date. The CVSS vector shows high impact across all primary CIA metrics (VC:H/VI:H/VA:H) with unchanged scope (S:U in CVSS 3.x terminology), meaning full device compromise is achievable. Key missing data points include EPSS probability score and confirmation of active exploitation beyond POC publication. For consumer/SOHO routers like F456, patch deployment challenges are severe-Tenda's historical patch release cadence is poor and most end users never update router firmware. This creates persistent vulnerable populations even after theoretical patch availability. Priority should be HIGH for networks using Tenda F456, particularly those Internet-facing or in commercial deployments where router compromise enables lateral movement.

An attacker scans Internet-facing Tenda F456 routers using Shodan or Censys to identify devices exposing web management interfaces on TCP port 80/443. After authenticating with default credentials (admin/admin) or credentials obtained through prior breaches, the attacker sends a crafted HTTP POST request to http://[router-ip]/goform/L7Prot with an oversized 'page' parameter value designed to overflow the stack buffer in frmL7ProtForm. The buffer overflow overwrites the return address, redirecting execution to attacker-supplied shellcode that establishes persistent backdoor access with root privileges, enabling DNS hijacking, traffic interception, or pivot into the internal network. The publicly available GitHub POC provides ready-to-use exploit code requiring minimal modification.