CVE-2026-3168
Buffer Overflow in Tenda F453 httpd Enables Remote Exploit
Publication date: 2026-02-25
Last updated on: 2026-02-25
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f453_firmware | 1.0.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3168 is a critical buffer overflow vulnerability in the Tenda F453 router firmware version 1.0.0.3. It occurs in the function fromNatStaticSetting within the httpd component, specifically in the /goform/NatStaticSetting endpoint. The vulnerability arises because the argument "page" is improperly handled, allowing an attacker to manipulate input data that overflows the buffer by copying data without verifying the input size against the output buffer size.'}, {'type': 'paragraph', 'content': 'This buffer overflow can be exploited remotely without authentication, potentially allowing an attacker to execute arbitrary code or cause a denial of service on the device.'}] [1, 3]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including remote code execution and denial of service on the affected Tenda F453 router. An attacker exploiting this flaw can compromise the confidentiality, integrity, and availability of the device.
- Remote attackers can exploit the vulnerability without any local access or authentication.
- Compromise of device functionality, potentially disrupting network services.
- Execution of arbitrary code, which could lead to full control over the device.
- Denial of service conditions, making the device unavailable.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability affects the Tenda F453 router firmware version 1.0.0.3, specifically the /goform/NatStaticSetting endpoint in the httpd component. Detection would involve monitoring or testing for attempts to exploit the buffer overflow via manipulation of the "page" argument in requests to this endpoint.'}, {'type': 'paragraph', 'content': 'Since the exploit is publicly available, one could use crafted HTTP requests targeting the /goform/NatStaticSetting endpoint with manipulated "page" parameters to test if the device is vulnerable.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send HTTP POST requests to http://<router-ip>/goform/NatStaticSetting with varying "page" parameter values to observe abnormal behavior or crashes.'}, {'type': 'list_item', 'content': 'Example command: curl -X POST -d "page=<malicious_payload>" http://<router-ip>/goform/NatStaticSetting'}, {'type': 'list_item', 'content': 'Monitor network traffic for unusual POST requests to /goform/NatStaticSetting that include suspicious or oversized "page" parameters.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'No known mitigations or countermeasures have been identified for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda F453 router running firmware version 1.0.0.3 with an alternative device or firmware version that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restricting remote access to the router's management interface and monitoring for exploit attempts may help reduce risk until replacement or patching is possible."}] [3]