Tenda F456 EUVD-2026-25726

Exploitation requires the attacker to possess valid administrative credentials for the Tenda F456 router web interface (CVSS PR:L - low privileges required). The SafeUrlFilter endpoint at /goform/SafeUrlFilter must be accessible to the authenticated user, which is typically the case in default configurations where authenticated admin users have access to all management functions. Network connectivity to the router's web interface is required (AV:N), either from the local LAN or via internet if remote administration is enabled. No user interaction is needed once authentication is achieved (UI:N). The attack complexity is low (AC:L) with the public POC providing ready-made exploitation guidance. Exploitation is NOT possible against routers with strong admin passwords that prevent initial authentication, or against routers with web interface access restricted to specific IP ranges that exclude the attacker's location.

The CVSS 4.0 score of 7.4 reflects high severity with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L). The E:P modifier confirms proof-of-concept code exists. However, the PR:L requirement means attackers need valid router administrative credentials - this is not an unauthenticated RCE. Real-world risk depends heavily on credential security: default/weak passwords on internet-facing routers make this exploitable at scale, while properly secured devices with strong admin passwords face lower immediate risk. The public GitHub POC (Litengzheng/vuldb_new) provides attackers with working exploit code, reducing exploitation complexity significantly. No CISA KEV listing suggests this is not yet seeing widespread exploitation in the wild, but the combination of public exploit and home router target makes this a strong candidate for botnet recruitment campaigns. EPSS data is not available for this recent CVE, limiting quantitative exploitation probability assessment. The CVSS vector shows no scope change (SC:N/SI:N/SA:N), meaning exploitation is contained to the router itself - however, compromising a network gateway device provides attackers with persistent access to monitor/manipulate all network traffic, making actual impact broader than the technical scope suggests.

An attacker who has obtained valid administrative credentials for the Tenda F456 router (either through password guessing, credential stuffing, or social engineering) connects to the router's web interface over the network. They craft a malicious HTTP request to /goform/SafeUrlFilter with an oversized 'page' parameter value designed to overflow the buffer and overwrite the return address on the stack. When the fromSafeUrlFilter function returns, execution jumps to attacker-controlled shellcode embedded in the overflow payload, granting arbitrary code execution with httpd process privileges. The attacker installs persistent backdoor access, modifies DNS settings to redirect traffic through attacker-controlled servers, or enlists the router in a botnet for DDoS attacks.