A vulnerability exists in the Telnet Service of Tenda F453 routers running firmware version 1.0.0.3 or earlier. The flaw lies in the TendaTelnet function accessed through the /goform/telnet endpoint, allowing an attacker to inject arbitrary operating‑system commands. This results in execution of those commands on the device, giving attackers the ability to gain control or use the router as a pivot point.

The affected devices are Tenda F453 routers with firmware 1.0.0.3 or earlier. No other Tenda models or firmware releases are listed as vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 3% indicates a low probability of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. The attack can be carried out remotely by sending a crafted request to the Telnet Service; successful exploitation would grant the attacker the ability to execute commands on the device. Given the remote nature of the attack vector, operators should treat this as a high‑risk flaw if the service is exposed to untrusted networks.