CVE-2026-3729

Tenda F453 PPTPDClient fromPptpUserAdd stack-based overflow

View on CVE.org
Published Mar 8, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Tenda F453 1.0.0.3/3.As. Impacted is the function fromPptpUserAdd of the file /goform/PPTPDClient. Such manipulation of the argument username/opttype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the Tenda F453 firmware in the function fromPptpUserAdd located within /goform/PPTPDClient. By supplying a crafted username or opttype parameter, an attacker can trigger the overflow and execute arbitrary code on the device. The vulnerability is a classic buffer overflow (CWE‑119, CWE‑121) and thus compromises the confidentiality, integrity, and availability of the affected device if successfully exploited.

Affected Systems

The problem is present in Tenda F453 models running firmware version 1.0.0.3/3.As, as identified through vendor/product identifiers and the matching CPE entries for the firmware. No other versions have been explicitly listed as affected.

Risk and Exploitability

The CVSS base score of 8.7 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability can be triggered remotely through HTTP requests to the /goform/PPTPDClient endpoint. Publicly available exploits have been referenced, implying that the threat is real. The vulnerability is not currently listed in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to a firmware revision that includes the fix for the /goform/PPTPDClient buffer overflow.
  • If an upgrade is not immediately possible, disable the PPTP service or block access to the /goform/PPTPDClient endpoint to prevent exploitation.
  • Continue to monitor device logs for attempts to access the vulnerable endpoint or for unusually large username parameters and apply patching as soon as it becomes available.

Generated by OpenCVE AI on April 16, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Tenda f453
Vendors & Products Tenda f453
Type Values Removed Values Added
Description A vulnerability was identified in Tenda F453 1.0.0.3/3.As. Impacted is the function fromPptpUserAdd of the file /goform/PPTPDClient. Such manipulation of the argument username/opttype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Title Tenda F453 PPTPDClient fromPptpUserAdd stack-based overflow
First Time appeared Tenda
Tenda f453 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f453_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 11, 2026, 3:32 PM
Reserved
Mar 7, 2026, 5:44 PM

View source JSON

Updated
Mar 11, 2026, 3:32 PM

JSON

Status
Analyzed
Published
Mar 8, 2026, 11:15 AM
Modified
Jun 17, 2026, 10:44 AM

View source JSON

No data.

Updated
Apr 16, 2026, 4:30 AM

JSON