A vulnerability exists in the Telnet Service of Tenda F453 routers running firmware version 1.0.0.3 or earlier. The flaw resides in the TendaTelnet function accessed through the /goform/telnet endpoint and allows an attacker to inject arbitrary operating‑system commands. This results in the execution of those commands on the device, giving attackers a foothold that can lead to full compromise or misuse of the router as a pivot point.

The affected devices are Tenda F453 routers with firmware 1.0.0.3 or earlier. No other Tenda models or firmware releases are listed as vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. The attack can be carried out remotely by sending a crafted request to the Telnet Service; successful exploitation would grant the attacker the ability to execute commands on the device. Given the remote nature of the attack vector, operators should treat this as a high‑risk flaw if the service is exposed to untrusted networks.