Executive brief
A vulnerability exists in the Tenda F456 router, a device used to provide wireless internet connectivity. An attacker can exploit this flaw to crash the device or potentially take full control of it by sending a specially crafted web request. This could lead to a complete loss of internet service or unauthorized access to the network traffic passing through the router.
Technical details
A stack-based buffer overflow vulnerability exists in the 'httpd' service of the Tenda F456 router (version 1.0.0.5). The flaw is located in the 'fromNatStaticSetting' function within the '/goform/NatStaticSetting' file. The root cause is the unsafe use of the 'sprintf' function when processing the user-provided 'page' parameter, which lacks proper length validation before being copied into a stack buffer. An attacker with network access and low-level authentication can exploit this by sending a crafted POST request to trigger the overflow. Successful exploitation can lead to a denial of service (DoS) or remote code execution (RCE). A public exploit (PoC) has been disclosed.
Affected products
- Tenda F456 1.0.0.5
Timeline
- 2026-04-13: disclosed: Vulnerability disclosed and CVE assigned.
- 2026-04-13: advisory: NVD published the vulnerability details.