CVE-2026-3166
Published: 25 February 2026
Summary
CVE-2026-3166 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow flaw in the fromRouteStatic function of the httpd component by identifying, reporting, and applying patches.
Validates the 'page' argument to prevent manipulation that triggers the buffer overflow in /goform/RouteStatic.
Implements memory safeguards such as ASLR and DEP to mitigate arbitrary code execution or crashes from the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router httpd web interface (fromRouteStatic, 'page' param) enables remote unauthenticated/low-priv RCE over network, directly mapping to exploitation of public-facing applications for initial access.
NVD Description
A vulnerability was identified in Tenda F453 1.0.0.3. The affected element is the function fromRouteStatic of the file /goform/RouteStatic of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The…
more
exploit is publicly available and might be used.
Deeper analysisAI
CVE-2026-3166 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting the Tenda F453 router on firmware version 1.0.0.3. The flaw exists in the fromRouteStatic function within the /goform/RouteStatic file of the httpd component, where manipulation of the "page" argument triggers the overflow.
The vulnerability enables remote exploitation by an attacker possessing low privileges (PR:L), with low attack complexity over the network (AV:N/AC:L/UI:N). Its CVSS v3.1 base score of 8.8 (C:H/I:H/A:H/S:U) indicates high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system crashes. A public exploit is available and might be used.
Advisories provide details via VulDB entries (ctiid.347673, id.347673, submit.759589) and a GitHub repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_65/README.md containing exploit information. The vendor site https://www.tenda.com.cn/ is referenced, though specific patch or mitigation guidance is not detailed in the disclosure.
Details
- CWE(s)