CVE-2026-3378
Remote Buffer Overflow in Tenda F453 QoS Setting Function
Publication date: 2026-03-01
Last updated on: 2026-03-03
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f453_firmware | 1.0.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3378 is a critical buffer overflow vulnerability found in the Tenda F453 router, version 1.0.0.3. The flaw exists in the function fromqossetting located in the /goform/qossetting endpoint. It arises from improper handling of the qos argument, where the input buffer is copied to an output buffer without verifying that the input size is smaller than the output buffer size. This leads to a classic buffer overflow condition.
The vulnerability can be exploited remotely without authentication, allowing an attacker to manipulate the qos argument to cause the overflow. The exploit is publicly available and considered easy to execute.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to execute arbitrary code or cause a denial of service on the affected Tenda F453 router. It compromises the confidentiality, integrity, and availability of the device.
Because the exploit is easy to execute and publicly available, attackers can remotely take control of the device or disrupt its normal operation, potentially affecting network security and stability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability affects the Tenda F453 router firmware version 1.0.0.3, specifically the /goform/qossetting endpoint handling the qos argument. Detection involves identifying attempts to exploit the buffer overflow remotely by monitoring HTTP requests to this endpoint.'}, {'type': 'paragraph', 'content': 'Since the exploit is publicly available and targets the qos parameter in /goform/qossetting, network detection can focus on inspecting HTTP traffic for unusual or malformed requests to this path.'}, {'type': 'paragraph', 'content': 'Suggested commands for detection include using network monitoring tools like tcpdump or tshark to filter HTTP requests to /goform/qossetting, for example:'}, {'type': 'list_item', 'content': "tcpdump -i <interface> -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/qossetting'"}, {'type': 'list_item', 'content': 'tshark -Y \'http.request.uri contains "/goform/qossetting"\' -T fields -e http.request.method -e http.request.uri'}, {'type': 'paragraph', 'content': 'Additionally, checking device logs for unusual activity or crashes related to the QoS settings handler may help detect exploitation attempts.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'There are no known countermeasures or mitigations currently identified for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda F453 router firmware version 1.0.0.3 with a secure version or a different device to avoid exploitation.'}, {'type': 'paragraph', 'content': "Until a patch or update is available, it is advisable to restrict access to the router's management interface, especially blocking remote HTTP access to the /goform/qossetting endpoint."}, {'type': 'paragraph', 'content': 'Monitoring network traffic for exploitation attempts and disabling QoS features if possible may also reduce risk.'}] [2]