CVE-2026-3167
Published: 25 February 2026
Summary
CVE-2026-3167 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the buffer overflow vulnerability by applying vendor patches or firmware updates to the Tenda F453 httpd component.
Information input validation enforces proper bounds checking on the webSiteId argument in the formWebTypeLibrary function, preventing the buffer overflow exploitation.
Memory protection mechanisms such as address space layout randomization and data execution prevention mitigate arbitrary code execution from the buffer overflow in the httpd component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a buffer overflow in the web management interface (httpd /goform/webtypelibrary) of a public-facing router, enabling remote exploitation for arbitrary code execution, directly mapping to Exploit Public-Facing Application.
NVD Description
A security flaw has been discovered in Tenda F453 1.0.0.3. The impacted element is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component httpd. Performing a manipulation of the argument webSiteId results in buffer overflow. The attack may be…
more
initiated remotely. The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-3167 is a buffer overflow vulnerability affecting the Tenda F453 router running firmware version 1.0.0.3. The flaw resides in the formWebTypeLibrary function within the /goform/webtypelibrary endpoint of the httpd component. It is triggered by manipulating the webSiteId argument, leading to improper bounds checking as associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The vulnerability was published on 2026-02-25 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.
Advisories and additional details are available through references including a GitHub repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_66/README.md, multiple VulDB entries at https://vuldb.com/?ctiid.347674, https://vuldb.com/?id.347674, and https://vuldb.com/?submit.759594, and the vendor site at https://www.tenda.com.cn/. These sources may provide guidance on patches or mitigations, though specific remediation steps are not detailed here.
The exploit for CVE-2026-3167 has been publicly released, increasing the risk of active attacks against unpatched Tenda F453 devices.
Details
- CWE(s)