Description
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Published: 2026-03-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via stack overflow
Action: Immediate patch
AI Analysis

Impact

A stack-based buffer overflow exists in the PPTPUserSetting function of Tenda F453 router firmware 1.0.0.3. By manipulating the delno parameter in the web form /goform/PPTPUserSetting, an attacker can overwrite the stack, potentially hijacking execution flow and achieving remote code execution. The vulnerability stems from unchecked input handling and is related to CWE-119, CWE-121 and CWE-787.

Affected Systems

Tenda F453 routers running firmware 1.0.0.3 are affected. Only this firmware revision is documented as vulnerable. The flaw resides in the httpd component handling PPTP user settings, accessed through the router’s web interface.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity, while the EPSS score is below 1%, suggesting low current exploitation probability. However, publicly available exploits exist, meaning the risk is not negligible. The vulnerability is not listed in the KEV catalog. Attackers can exploit the flaw remotely without authentication via the router’s web interface, potentially executing arbitrary code on the device and compromising network traffic.

Generated by OpenCVE AI on March 30, 2026 at 20:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire the latest firmware from Tenda’s official website and install it on the affected router.
  • If a patched firmware is unavailable, remove or disable the PPTP configuration feature via the router’s administration interface, or block access to /goform/PPTPUserSetting.
  • Place the router behind a firewall and restrict inbound access to the HTTP management interface to trusted IP addresses.
  • Regularly monitor router logs for anomalous POST requests to /goform/PPTPUserSetting or signs of buffer‑overflow attempts.
  • Keep other network devices and services up to date to reduce the impact in case an attacker gains remote code execution on the router.

Generated by OpenCVE AI on March 30, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:h:tenda:f453:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:f453_firmware:1.0.0.3:*:*:*:*:*:*:*

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda f453
Vendors & Products Tenda f453

Sun, 29 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Title Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow
First Time appeared Tenda
Tenda f453 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:f453_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f453 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F453 F453 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:32:17.535Z

Reserved: 2026-03-27T14:17:42.535Z

Link: CVE-2026-5021

cve-icon Vulnrichment

Updated: 2026-03-30T14:32:14.274Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-29T02:16:17.377

Modified: 2026-03-30T19:01:13.423

Link: CVE-2026-5021

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T20:56:56Z

Weaknesses