CVE-2026-3272
Buffer Overflow in Tenda F453 httpd Enables Remote Exploitation
Publication date: 2026-02-27
Last updated on: 2026-02-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f453_firmware | 1.0.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3272 is a critical buffer overflow vulnerability found in the Tenda F453 router, version 1.0.0.3. It exists in the function fromDhcpListClient within the httpd component, specifically in the file /goform/DhcpListClient. The vulnerability arises from improper handling of the "page" argument, where an input buffer is copied to an output buffer without verifying that the input size is smaller than the output buffer size. This leads to a classic buffer overflow condition.'}, {'type': 'paragraph', 'content': 'This flaw allows remote exploitation without authentication, meaning an attacker can trigger the vulnerability over the network. The issue is classified under CWE-120 (buffer overflow).'}] [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact the confidentiality, integrity, and availability of the affected Tenda F453 router device.
- An attacker can remotely exploit the buffer overflow to execute arbitrary code.
- It can cause denial of service by crashing or destabilizing the device.
The attack complexity is low, and no authentication is required, increasing the risk of exploitation.
There are currently no known countermeasures or mitigations, and replacement of the affected product is recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability affects the Tenda F453 router version 1.0.0.3, specifically the function fromDhcpListClient in the /goform/DhcpListClient endpoint of the httpd component. Detection would involve checking if the device is running this specific firmware version and monitoring for unusual or malformed requests to the /goform/DhcpListClient path that could trigger the buffer overflow.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is triggered by manipulation of the "page" argument in requests to /goform/DhcpListClient, network detection could involve inspecting HTTP requests to this endpoint for suspicious or oversized "page" parameters.'}, {'type': 'paragraph', 'content': 'No explicit detection commands are provided in the resources, but general approaches could include:'}, {'type': 'list_item', 'content': 'Using network traffic capture tools (e.g., tcpdump, Wireshark) to filter HTTP requests to /goform/DhcpListClient and analyze the "page" parameter.'}, {'type': 'list_item', 'content': 'Using curl or wget to manually send crafted requests to the /goform/DhcpListClient endpoint to test for abnormal responses or crashes.'}, {'type': 'list_item', 'content': 'Checking the device firmware version via its management interface or command line to confirm if it is version 1.0.0.3, which is vulnerable.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'There are no known countermeasures or mitigations currently available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda F453 router running firmware version 1.0.0.3 with an alternative device or firmware version that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restricting access to the device's management interface and monitoring for suspicious activity targeting the /goform/DhcpListClient endpoint may help reduce risk until replacement."}] [2]