CVE-2026-4554 identifies a command injection vulnerability in the Tenda F453 router firmware version 1.0.0.3. The vulnerability resides in the FormWriteFacMac function, specifically in the /goform/WriteFacMac endpoint, where the 'mac' parameter is improperly validated or sanitized. This flaw allows an attacker to inject arbitrary shell commands remotely without requiring authentication or user interaction. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L) and no privileges required (PR:L), indicating that an attacker with limited privileges can exploit it. The CVSS 4.0 base score is 5.3, reflecting medium severity, with partial impacts on confidentiality, integrity, and availability. The exploit code has been publicly released, increasing the risk of exploitation, although no active exploitation in the wild has been reported yet. The vulnerability affects only version 1.0.0.3 of the firmware, and no official patches have been linked yet. The flaw could allow attackers to gain control over the router, potentially leading to network compromise, data interception, or further lateral attacks within affected environments.

The impact of CVE-2026-4554 is significant for organizations deploying Tenda F453 routers, especially those using the vulnerable firmware version 1.0.0.3. Successful exploitation allows remote attackers to execute arbitrary commands on the device, potentially leading to full device compromise. This can result in unauthorized access to internal networks, interception or manipulation of network traffic, disruption of network services, and use of the device as a foothold for further attacks. The compromise of network infrastructure devices like routers can severely affect confidentiality, integrity, and availability of organizational data and services. Given the public availability of exploit code, the risk of automated or targeted attacks increases. Organizations relying on these routers in critical environments such as enterprises, ISPs, or government agencies face heightened risks of espionage, data breaches, or service outages.

To mitigate CVE-2026-4554, organizations should immediately identify and inventory all Tenda F453 devices running firmware version 1.0.0.3. Since no official patch is currently linked, temporary mitigations include restricting access to the router management interface to trusted networks only, employing network segmentation to isolate vulnerable devices, and implementing strict firewall rules to block unauthorized inbound traffic to the /goform/WriteFacMac endpoint. Monitoring network traffic for unusual commands or anomalies related to the 'mac' parameter can help detect exploitation attempts. Additionally, organizations should contact Tenda support for firmware updates or advisories and apply patches promptly once available. Where feasible, consider replacing vulnerable devices with updated models or alternative vendors with better security track records. Regularly updating firmware and disabling unnecessary services can reduce attack surface.