Description
A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-02-28
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the fromSafeMacFilter function of the /goform/SafeMacFilter endpoint in Tenda F453 firmware 1.0.0.3. An attacker can send crafted input via the page argument, causing a buffer overflow that may compromise local system memory. This can lead to arbitrary code execution or denial of service. The weakness maps to CWE-119 and CWE-120.

Affected Systems

Devices running Tenda F453 firmware 1.0.0.3 are affected. The product is a consumer router manufactured by Tenda. No other firmware versions were specified as vulnerable.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation for the moment. The vulnerability is not listed in the CISA KEV catalog, but public exploits have been disclosed and can be triggered remotely, likely via HTTP requests to /goform/SafeMacFilter. The attack does not require authentication and targets the wireless MAC filtering functionality.

Generated by OpenCVE AI on April 16, 2026 at 15:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to the latest firmware that contains a fix for the buffer overflow.
  • If no firmware update is available, disable or restrict access to the /goform/SafeMacFilter endpoint by applying a firewall rule or disabling the MAC filtering feature.
  • Monitor router logs for anomalous activity and apply an intrusion detection system to detect potential exploitation attempts.

Generated by OpenCVE AI on April 16, 2026 at 15:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Mar 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*

Mon, 02 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda f453
Vendors & Products Tenda f453

Sat, 28 Feb 2026 23:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow
First Time appeared Tenda
Tenda f453 Firmware
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:o:tenda:f453_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F453 F453 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-06T15:10:17.707Z

Reserved: 2026-02-28T06:55:30.910Z

Link: CVE-2026-3376

cve-icon Vulnrichment

Updated: 2026-03-06T15:10:12.618Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-28T23:16:01.177

Modified: 2026-03-03T17:35:16.400

Link: CVE-2026-3376

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T15:15:39Z

Weaknesses