CVE-2026-3169
Published: 25 February 2026
Summary
CVE-2026-3169 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through firmware updates directly eliminates the buffer overflow vulnerability in the Tenda F453 httpd component exploited via the 'page' argument.
Information input validation and sanitization on the /goform/SafeEmailFilter endpoint prevents the buffer overflow triggered by manipulation of the 'page' argument.
Memory protection mechanisms like stack canaries, ASLR, and non-executable stacks mitigate exploitation of the buffer overflow even in unpatched firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd web endpoint (/goform/SafeEmailFilter) directly enables remote exploitation of the application (T1190) by low-privileged users and supports privilege escalation via arbitrary code execution on the device (T1068).
NVD Description
A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the file /goform/SafeEmailFilter of the component httpd. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible.…
more
The exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2026-3169 is a buffer overflow vulnerability affecting the Tenda F453 router running firmware version 1.0.0.3. The issue resides in the fromSafeEmailFilter function within the /goform/SafeEmailFilter endpoint of the httpd component, where manipulation of the "page" argument triggers the overflow. This flaw, associated with CWE-119 and CWE-120, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-25.
The vulnerability enables remote exploitation by low-privileged users over the network with low attack complexity and no user interaction required. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially allowing attackers to execute arbitrary code or cause denial of service on the affected device.
Advisories and references, including those from VulDB and a GitHub repository, document the vulnerability and disclose a public exploit. The vendor's site at tenda.com.cn is listed among references, though specific patch details are not detailed in the available information. Security practitioners should check these sources for mitigation guidance and firmware updates.
Notable context includes the public disclosure of an exploit, increasing the risk of real-world attacks against unpatched Tenda F453 devices.
Details
- CWE(s)