Tenda F456 EUVD-2026-25788

Requires valid low-privilege credentials for the Tenda F456 web management interface (PR:L in CVSS vector). The httpd service must be network-accessible to the attacker, which is the default configuration for router management interfaces. No specific non-default configuration or special feature enablement is required beyond the vulnerable firmware version 1.0.0.5 being installed. Exploitation is LIMITED by the authentication requirement - attackers must first compromise credentials via brute-force, credential stuffing, default password exploitation, or social engineering before the buffer overflow can be triggered. Network accessibility (WAN vs LAN-only management) significantly impacts realistic exploitability, with WAN-exposed management interfaces representing higher risk.

Real-world risk is MODERATE-HIGH despite the 7.4 CVSS score. The CVSS:4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity but requires low-privilege authentication, which significantly reduces the attack surface compared to unauthenticated RCE. The E:P (Proof-of-concept) modifier confirms publicly available exploit code on GitHub, making weaponization straightforward for attackers who obtain credentials via credential stuffing, default passwords, or social engineering. However, no CISA KEV listing suggests this is not yet widely exploited in the wild. EPSS data is absent from the provided intelligence. The SSVC decision framework would likely classify this as 'Scheduled' rather than 'Immediate' due to the authentication prerequisite, but organizations with Tenda F456 devices exposed to untrusted networks (guest Wi-Fi admins, IoT segregation failures) face elevated risk. The combination of public exploit availability and router devices' typical security posture (infrequent patching, weak default credentials) makes this a realistic threat for targeted attacks against small office/home office environments.

An attacker first obtains credentials to the Tenda F456 web interface through credential stuffing attacks against default passwords (admin/admin) or phishing targeting the device owner. Once authenticated, the attacker crafts a malicious HTTP POST request to the /goform/webExcptypemanFilter endpoint with an oversized 'page' parameter containing shellcode and a return address overwrite. The buffer overflow corrupts the stack, redirecting execution to attacker-controlled code that executes with root privileges, enabling installation of persistent backdoors, network traffic interception, or pivot attacks into the internal network.