CVE-2026-3726
Stack-Based Buffer Overflow in Tenda F453 Remote Exploit
Publication date: 2026-03-08
Last updated on: 2026-03-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | f453_firmware | 1.0.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can have severe impacts including denial of service (DoS), where the device may crash or become unresponsive, and remote code execution (RCE), where an attacker can execute arbitrary code on the affected router remotely.
Because the exploit can be triggered remotely without authentication, it poses a high risk to the confidentiality, integrity, and availability of the device and the network it supports.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3726 is a stack-based buffer overflow vulnerability found in the Tenda F453 router, version 1.0.0.3. It exists in the function fromwebExcptypemanFilter within the file /goform/webExcptypemanFilter. The vulnerability arises because the function improperly handles a user-supplied parameter named "page" by passing it to the sprintf function without any bounds checking. This allows an attacker to send an excessively long "page" parameter, causing the stack buffer to overflow.'}, {'type': 'paragraph', 'content': 'Exploiting this vulnerability can lead to denial of service (DoS) or remote code execution (RCE) on the affected device. The attack can be initiated remotely without requiring local access.'}] [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the endpoint /goform/webExcptypemanFilter containing an excessively long or malformed "page" parameter.'}, {'type': 'paragraph', 'content': 'A proof of concept involves sending a crafted HTTP POST request with a large payload in the "page" parameter to trigger the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'To detect potential exploitation attempts on your network or system, you can use network monitoring tools or packet capture utilities (e.g., tcpdump or Wireshark) to filter HTTP POST requests targeting /goform/webExcptypemanFilter and inspect the length and content of the "page" parameter.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/webExcptypemanFilter'"}, {'type': 'list_item', 'content': "Use curl or similar tools to test the endpoint with a crafted payload: curl -X POST http://<router-ip>/goform/webExcptypemanFilter -d 'page=<very_long_string>'"}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /goform/webExcptypemanFilter by implementing firewall rules or access control lists to block unauthorized or external access.
Since no known mitigations or patches are currently identified, consider replacing the affected Tenda F453 router firmware version 1.0.0.3 with a newer, patched version or an alternative device.
Monitor network traffic for exploitation attempts and disable any unnecessary services that expose the vulnerable function.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know