Description
A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. The manipulation of the argument GO leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Published: 2026-03-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A stack-based buffer overflow exists in the Tenda F453 firmware 1.0.0.3, triggered by manipulation of the GO parameter on the /goform/WrlExtraSet endpoint. The overflow can be exploited remotely to execute arbitrary code, leading to full control of the device. The vulnerability has been publicly disclosed and may be used by attackers.

Affected Systems

Tenda F453 router running firmware version 1.0.0.3. No additional versions are currently known to be affected.

Risk and Exploitability

The CVSS score of 8.7 indicates a high-impact flaw with high severity. EPSS indicates a very low, but non-zero, exploitation probability of less than 1 percent. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is possible over a remote network, likely via the router’s web interface, and would allow an attacker to achieve remote code execution on the device.

Generated by OpenCVE AI on April 16, 2026 at 04:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to a firmware version that removes the stack-based overflow in the /goform/WrlExtraSet endpoint; check the vendor’s support site for a patch or new release.
  • Configure network segmentation or firewall rules to block or restrict inbound traffic to the router’s web management interface, especially to the /goform/WrlExtraSet endpoint.
  • Monitor device logs for repeated, malformed requests to /goform/WrlExtraSet and investigate any suspicious activity promptly.

Generated by OpenCVE AI on April 16, 2026 at 04:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda f453
Vendors & Products Tenda f453

Sun, 08 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. The manipulation of the argument GO leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title Tenda F453 WrlExtraSet formWrlExtraSet stack-based overflow
First Time appeared Tenda
Tenda f453 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f453_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F453 F453 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-10T20:36:26.165Z

Reserved: 2026-03-07T20:54:54.405Z

Link: CVE-2026-3768

cve-icon Vulnrichment

Updated: 2026-03-10T20:35:59.593Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T21:15:51.267

Modified: 2026-03-09T15:17:08.960

Link: CVE-2026-3768

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T04:15:24Z

Weaknesses