CVE-2026-4554 - Vulnerability Details

- Tenda F453 WriteFacMac FormWriteFacMac privilege escalation

Description

A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Published: 2026-03-22

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the Tenda F453 firmware version 1.0.0.3 allows an attacker to inject arbitrary shell commands via the mac argument to the /goform/WriteFacMac form. This results in remote code execution on the device, enabling full control over the affected device. The weakness is related to command injection weaknesses listed as CWE‑74, CWE‑77, and CWE‑78.

Affected Systems

Vendors and products affected are the Tenda F453 wireless router. The specific firmware identified as vulnerable is version 1.0.0.3.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of 3% suggests a low probability of exploitation at present. The vulnerability has not been listed in CISA’s KEV catalog, but public exploit code is available. The attack vector is inferred to be remote, as the payload can be delivered over the network via the router’s web interface, making it potentially reachable from external or compromised internal hosts.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Tenda

F453

affected

Version	Status	Constraints
`1.0.0.3`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*

cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Tenda

F453

100%

Version	Status	Scheme	Platform
`1.0.0.3`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Tenda F453 firmware to a version that removes the vulnerable command injection in the FormWriteFacMac function
Verify the firmware version after the update to ensure the patch is in place
If an immediate firmware upgrade is not possible, restrict network access to the router’s administrative interface until the device can be updated
Monitor device logs for signs of attempted command injection or unauthorized access

Generated by OpenCVE AI on April 3, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00839.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Litengzheng/vul_db/blob/main/F453/vul_95/README.md
https://vuldb.com/?ctiid.352381
https://vuldb.com/?id.352381
https://vuldb.com/?submit.774933
https://www.tenda.com.cn/

History

Fri, 03 Apr 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-78
CPEs		cpe:2.3:h:tenda:f453:-:::::::* cpe:2.3:o:tenda:f453_firmware:1.0.0.3:::::::*

Wed, 25 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Mar 2026 10:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenda f453
Vendors & Products		Tenda f453

Sun, 22 Mar 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Title		Tenda F453 WriteFacMac FormWriteFacMac privilege escalation
First Time appeared		Tenda Tenda f453 Firmware
Weaknesses		CWE-74 CWE-77
CPEs		cpe:2.3:o:tenda:f453_firmware::::::::
Vendors & Products		Tenda Tenda f453 Firmware
References		https://github.com/Litengzheng/vul_db/blob/main/F453/vul_95/README.md https://vuldb.com/?ctiid.352381 https://vuldb.com/?id.352381 https://vuldb.com/?submit.774933 https://www.tenda.com.cn/
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Tenda F453 F453 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-22T16:51:18.212Z

Updated: 2026-03-25T13:48:37.328Z

Reserved: 2026-03-21T16:57:19.753Z

Link: CVE-2026-4554

Vulnrichment

Updated: 2026-03-25T13:48:33.928Z

NVD

Status : Analyzed

Published: 2026-03-22T17:17:09.730

Modified: 2026-04-03T11:32:04.143

Link: CVE-2026-4554

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-03T21:18:12Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object