Tenda F456 EUVD-2026-25765

Exploitation requires authenticated access to the Tenda F456 web management interface with low-privilege credentials (PR:L in CVSS vector). Specific conditions: (1) Attacker must successfully authenticate to the router's httpd service on TCP port 80 or 443 - this can be default credentials, compromised credentials, or any valid user account with access to wireless configuration features. (2) The /goform/WrlExtraSet endpoint must be accessible to the authenticated session, which is typically enabled by default in Tenda router firmware for wireless settings management. (3) No special wireless configuration or non-default settings required - the vulnerable function is part of standard wireless extra settings functionality. Exploitation is LIMITED by: Router must be network-accessible to attacker (LAN access or Internet-facing management interface). If remote management is disabled on WAN interface (common security practice), attack surface reduces to LAN-based adversaries only. Authentication requirement (PR:L) prevents drive-by exploitation, though Tenda routers commonly ship with default admin/admin credentials that remain unchanged in many deployments.

Real-world risk is MODERATE-HIGH for exposed Tenda F456 routers with default or weak credentials. CVSS v4.0 vector indicates network-accessible exploitation (AV:N) with low complexity (AC:L), requiring only low-privilege authentication (PR:L) and no user interaction (UI:N). Impact is severe with High ratings across Vulnerable System Confidentiality, Integrity, and Availability (VC:H/VI:H/VA:H), though no Subsequent System impact (SC:N/SI:N/SA:N), indicating the compromise is contained to the router itself. The E:P (Exploit Maturity: Proof-of-Concept) designation aligns with the publicly available GitHub exploit code, confirming weaponization feasibility. However, exploitation is LIMITED by two critical factors: (1) requires authenticated access, reducing attack surface compared to unauthenticated RCE, and (2) targets a specific legacy router model (F456 v1.0.0.5) with likely small deployment footprint. No CISA KEV listing suggests targeted rather than widespread exploitation. EPSS data not provided, but similar router CVEs with public POCs typically score 0.02-0.15 (2-15% exploitation probability). Primary risk is to SOHO/residential networks where Tenda F456 remains in service with weak credentials and Internet-facing management interfaces.

Attacker obtains low-privilege credentials for Tenda F456 router through credential stuffing attack using leaked password databases or by exploiting default credentials (admin/admin). From any Internet-connected location, attacker sends crafted HTTP POST request to http://[router_IP]/goform/WrlExtraSet with oversized 'Go' parameter value exceeding buffer bounds. The formWrlExtraSet function copies attacker-controlled data without length validation, overwriting stack memory and hijacking execution flow. Attacker achieves arbitrary code execution in httpd process context (typically root on embedded routers), enabling firmware modification, credential harvesting, DNS hijacking for man-in-the-middle attacks, or integration into IoT botnet. Public GitHub POC (Litengzheng/vuldb_new) provides working exploit template, lowering skill barrier to script-kiddie level.