Tenda F456 Router Hit by Critical Stack-Based Buffer Overflow

The National Vulnerability Database (NVD) has disclosed CVE-2026-6199, a high-severity vulnerability impacting the Tenda F456 router, specifically version 1.0.0.5. This isn’t just a theoretical issue; it’s a stack-based buffer overflow within the fromqossetting function, found in the /goform/qossetting file. The flaw can be triggered by manipulating the page argument.

What makes this particularly nasty is the remote exploitability and the fact that an exploit has already been made public. This means script kiddies and seasoned attackers alike could be leveraging this. A CVSSv3.1 score of 8.8 (HIGH) underscores the potential impact: full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity (AC:L) and no user interaction required (UI:N). It’s a classic case of CWE-119 and CWE-121, highlighting inadequate buffer handling.