Executive brief
A vulnerability has been identified in the Tenda F456 wireless router, a device used to provide internet connectivity for homes and small offices. An attacker can exploit this flaw to crash the device or potentially take full control of it by sending a specially crafted web request. This could lead to a complete loss of internet service or unauthorized access to the network traffic passing through the router.
Technical details
A stack-based buffer overflow exists in the Tenda F456 router (firmware version 1.0.0.5) within the 'httpd' service. The vulnerability is located in the 'formWrlsafeset' function in the '/goform/AdvSetWrlsafeset' file. The root cause is a lack of length validation when copying the user-provided 'mit_ssid' parameter into a stack buffer using the 'sprintf' function. A remote attacker with low privileges can exploit this by sending a crafted POST request with an overly long 'mit_ssid' string, leading to a denial of service (DoS) or remote code execution (RCE). A public exploit (PoC) is available.
Affected products
- Tenda F456 1.0.0.5
Timeline
- 2026-04-13: disclosed: Vulnerability disclosed and CVE assigned.
- 2026-04-13: advisory: Advisory published by VulDB and NVD.