Threat Intelligence Database

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-4553 is a high-severity stack-based buffer overflow vulnerability in the Tenda F453 router firmware version 1.0.0.3. The flaw exists in the fromNatlimit function within the /goform/Natlimit component, where improper handling of the 'page' argument allows remote attackers to overflow the stack. Exploitation requires no user interaction or privileges and can be initiated remotely over the network. Although no known exploits are currently observed in the wild, a public exploit is available, increasing the risk of attacks. Successful exploitation could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the device and potentially the network it protects. Organizations using Tenda F453 routers should prioritize patching or mitigating this vulnerability. Countries with significant deployments of Tenda networking equipment, especially in Asia and emerging markets, are at higher risk.

HighVulnerabilityChinaIndiaRussia+7#cve#cve-2026-4553

CVE-2026-4551 is a high-severity stack-based buffer overflow vulnerability affecting Tenda F453 routers running firmware version 1.0.0.3. The flaw exists in the fromSafeClientFilter function within the /goform/SafeClientFilter component, where manipulation of the 'menufacturer/Go' argument can trigger the overflow. This vulnerability can be exploited remotely without authentication or user interaction, enabling attackers to potentially execute arbitrary code or cause denial of service. Although no public exploit is currently observed in the wild, a proof-of-concept exploit has been made public, increasing the risk of exploitation. The vulnerability impacts confidentiality, integrity, and availability due to the possibility of full system compromise. Organizations using affected Tenda F453 devices should prioritize patching or mitigating this issue. Countries with significant deployment of Tenda networking equipment, especially in Asia and emerging markets, are at higher risk.

HighVulnerabilityChinaIndiaIndonesia+7#cve#cve-2026-4551

A security vulnerability has been detected in Tenda F453 1.0.0.3. This affects the function strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

HighVulnerabilityChinaUnited StatesIndia+7#cve#cve-2026-3732

A vulnerability was determined in Tenda F453 1.0.0.3/1.If. This issue affects the function fromSetCfm of the file /goform/setcfm. This manipulation of the argument funcname/funcpara1 causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

HighVulnerabilityChinaIndiaRussia+7#cve#cve-2026-3728

A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component httpd. Such manipulation of the argument mit_ssid_index leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

HighVulnerabilityChinaIndiaRussia+7#cve#cve-2026-3273

A vulnerability was found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pListFilterof of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

HighVulnerabilityChinaIndiaRussia+7#cve#cve-2026-3271

A weakness has been identified in Tenda F453 1.0.0.3. This affects the function fromNatStaticSetting of the file /goform/NatStaticSetting of the component httpd. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

HighVulnerabilityChinaIndiaRussia+7#cve#cve-2026-3168