Tenda F456 EUVD-2026-25725

Requires valid authentication to Tenda F456 web management interface - attacker must possess low-privilege credentials (PR:L in CVSS vector). Exploitation succeeds against routers with web management interface exposed to network (default configuration for LAN access, optionally enabled for WAN remote management). Specific limiting factors: (1) Authentication barrier - not exploitable without credentials, so risk depends on default/weak password usage; (2) Network reachability - if httpd bound only to LAN interface and WAN management disabled, limits attack surface to local network attackers or already-compromised LAN clients; (3) Firmware version specificity - only confirmed for 1.0.0.5, other versions not tested. No user interaction required (UI:N) once authenticated.

Real-world risk is MODERATE-HIGH with significant caveats. CVSS 7.4 reflects network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L) - meaning any authenticated user can exploit this. The publicly available GitHub POC (confirmed by exploit reference) lowers the barrier to exploitation. However, authentication requirement is the critical limiting factor: attackers need valid credentials first, either through default/weak passwords (common on consumer routers), credential stuffing, or prior compromise. CVSS E:P (Proof-of-concept code) confirms exploit maturity. No EPSS score provided, but router vulnerabilities with public exploits historically see adoption in botnet campaigns (Mirai successors) when combined with default credentials. No CISA KEV listing indicates no confirmed mass exploitation yet. SSVC perspective: exploitation=POC (not active), automatable=yes (if credentials obtained), technical impact=total (RCE with router control). Priority depends heavily on credential exposure - critical if default creds exist or are reused, moderate if strong unique passwords enforced. Data gap: no information on default credentials or authentication bypass chains that might escalate this to unauthenticated.

Attacker identifies Tenda F456 router via fingerprinting (Shodan, Censys, or local network scan). Using credential stuffing with common default passwords (admin/admin) or credentials from prior breach, attacker authenticates to web interface. Attacker crafts HTTP POST to /goform/VirtualSer with oversized menufacturer or Go parameter (per GitHub POC at https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_126/README.md), triggering buffer overflow in fromVirtualSer function. Shellcode in overflow payload executes with httpd process privileges (typically root on embedded devices), granting full router control - enabling DNS hijacking, traffic interception, lateral movement to LAN clients, or botnet recruitment.