Description
A security vulnerability has been detected in Tenda F453 1.0.0.3. This affects the function strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-03-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is caused by an unsafe use of the strcpy function in the /goform/exeCommand handler on Tenda F453 routers, leading to a stack-based buffer overflow that can be triggered by sending an oversized cmdinput string; the flaw is characterized by CWE-119 and CWE-121 and gives an attacker the ability to execute arbitrary code or commands on the device.

Affected Systems

Tenda F453 routers running firmware version 1.0.0.3 are affected; administrators should verify the precise firmware version on each device and confirm whether the product is from the Tenda F453 line.

Risk and Exploitability

The flaw carries a high CVSS score of 8.7 and, although the current EPSS probability is reported as less than 1 percent, a publicly disclosed exploit demonstrates that it can be abused remotely via the router’s HTTP interface; the vulnerability is not listed in the CISA KEV catalog, but its severity and remote reachability warrant immediate attention and mitigate the risk of full system compromise.

Generated by OpenCVE AI on April 16, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest Tenda F453 firmware that incorporates a fix for the buffer overflow in the exeCommand interface.
  • If an update is not immediately available, block external access to the /goform/exeCommand endpoint (e.g., via firewall rules or router access control lists).
  • Apply network segmentation and secure the router’s management interface, ensuring that only trusted local IP addresses can reach the device, and monitor logs for anomalous cmdinput activity.

Generated by OpenCVE AI on April 16, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda f453
Vendors & Products Tenda f453

Sun, 08 Mar 2026 11:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Tenda F453 1.0.0.3. This affects the function strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title Tenda F453 exeCommand strcpy stack-based overflow
First Time appeared Tenda
Tenda f453 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f453_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F453 F453 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-11T19:51:55.545Z

Reserved: 2026-03-07T17:56:32.936Z

Link: CVE-2026-3732

cve-icon Vulnrichment

Updated: 2026-03-11T19:51:52.569Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T11:15:50.523

Modified: 2026-03-09T15:19:10.740

Link: CVE-2026-3732

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T04:30:13Z

Weaknesses