Tenda F456 EUVD-2026-25763

Exploitation requires valid administrative credentials to the Tenda F456 router web interface - the CVSS vector confirms PR:L (low privileges required), indicating authenticated access is mandatory. The attacker must reach the router's web management interface over the network, which depends on deployment configuration: if remote management is enabled on the WAN interface, exploitation is possible from the internet; if restricted to LAN, the attacker must already have network access (via compromised internal system, physical presence, or compromised Wi-Fi). The PPTP server functionality must be present in the firmware, though it does not necessarily need to be actively configured with users. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning exploitation does not depend on race conditions, specific timing, or environmental variables once authentication is achieved. The vulnerability affects default configurations of firmware version 1.0.0.5 once the authentication barrier is cleared. Exploitation is limited by the need for prior credential compromise, which is a significant practical barrier against opportunistic mass exploitation but not against targeted attacks or environments with weak password practices.

Real-world risk is MODERATE to HIGH for affected deployments despite the 7.4 CVSS score. The CVSS v4.0 vector shows network-based attack (AV:N), low complexity (AC:L), and requires low privileges (PR:L) with no user interaction (UI:N), resulting in high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The Exploit maturity indicator (E:P) confirms publicly available proof-of-concept code exists, which the GitHub reference verifies. However, this is an authenticated attack requiring valid router admin credentials, which significantly limits opportunistic mass exploitation. No EPSS score was provided, and absence from CISA KEV suggests this is not yet seeing widespread active exploitation. Primary risk scenarios: targeted attacks against specific organizations using Tenda F456 routers where credentials have been compromised through phishing, default passwords, or credential stuffing; secondary risk from worm-like propagation if combined with authentication bypass. Consumer and small business deployments with weak admin passwords face elevated risk. The lack of vendor security advisory or confirmed patch from Tenda (as of provided references) increases residual risk for deployed devices.

An attacker who has obtained valid administrative credentials for a Tenda F456 router (through credential stuffing, phishing, or exploiting default passwords) authenticates to the web management interface. They send a specially crafted HTTP POST request to /goform/PPTPUserSetting with an oversized 'delno' parameter value exceeding the allocated buffer size. The fromPPTPUserSetting function copies this data without bounds checking, overwriting adjacent memory regions including return addresses or function pointers. The attacker leverages this memory corruption to redirect execution flow to injected shellcode, gaining arbitrary code execution with httpd process privileges (typically root on embedded systems). From this position, the attacker can install persistent backdoors, intercept network traffic, pivot to internal network resources, or enlist the router in a botnet. Public exploit code on GitHub (https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_132/README.md) provides attack primitives that lower the technical skill required for exploitation.