Description
A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the file /goform/SafeEmailFilter of the component httpd. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Published: 2026-02-25
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A buffer overflow exists in the fromSafeEmailFilter function used by the SafeEmailFilter component of the Tenda F453 router’s httpd service. By manipulating the page parameter in the /goform/SafeEmailFilter endpoint, a remote attacker can overwrite adjacent memory and execute arbitrary code, potentially granting full control of the device. The vulnerability is a classic memory corruption flaw, classified as CWE‑119 and CWE‑120, and carries a high CVSS score of 8.7.

Affected Systems

The flaw affects the Tenda F453 router running firmware version 1.0.0.3. No other firmware releases or product models are listed as affected in the current CNA data.

Risk and Exploitability

The CVSS score of 8.7 reflects a high‑severity threat, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. Based on the description, it is inferred that the attack vector is remote via HTTP, and the vulnerability does not explicitly require authentication or local privileges. A publicly disclosed exploit is available, suggesting that the risk is real and may materialize soon. The vulnerability is not currently catalogued in the CISA KEV list, but the combination of high impact and known public exploitation warrants immediate remediation.

Generated by OpenCVE AI on April 18, 2026 at 10:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available firmware update from Tenda that resolves the SafeEmailFilter buffer overflow.
  • If no patch is released, disable the SafeEmailFilter feature within the router’s web interface or block access to the /goform/SafeEmailFilter endpoint using firewall rules.
  • Restrict the router’s management interface to a local network or VPN, and block external HTTP/HTTPS traffic to the administration ports.

Generated by OpenCVE AI on April 18, 2026 at 10:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 25 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda f453
Tenda f453 Firmware
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453
Tenda f453 Firmware

Wed, 25 Feb 2026 08:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the file /goform/SafeEmailFilter of the component httpd. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title Tenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F453 F453 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-25T16:54:22.533Z

Reserved: 2026-02-24T21:58:54.824Z

Link: CVE-2026-3169

cve-icon Vulnrichment

Updated: 2026-02-25T16:54:00.712Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-25T08:16:19.507

Modified: 2026-02-25T17:52:33.197

Link: CVE-2026-3169

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T11:00:05Z

Weaknesses