This vulnerability allows remote attackers to perform command injection via the 'mac' parameter in the FromWriteFacMac function of the Tenda F456 router firmware 1.0.0.5. The affected endpoint is /goform/WriteFacMac within the httpd service. Exploitation requires no user interaction and can be performed over the network with low attack complexity and no privileges required. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. No official fix or mitigation has been published, and the device is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation could allow an attacker to execute arbitrary commands on the affected device remotely, potentially leading to unauthorized control or disruption of the router. The medium CVSS score reflects limited impact or complexity factors, but the presence of a public exploit increases the risk. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote administration features may reduce exposure.