CVE-2026-3378
Published: 01 March 2026
Summary
CVE-2026-3378 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the buffer overflow by requiring validation of the manipulated qos argument in the /goform/qossetting function.
Requires timely remediation of the specific buffer overflow flaw through firmware updates for the Tenda F453 1.0.0.3.
Provides memory protections like stack guards or ASLR to mitigate exploitation of the buffer overflow even if input validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow RCE in public router web form (/goform/qossetting) directly enables T1190 (exploit public-facing app) for remote access and T1068 (exploitation for privilege escalation) from low-priv web account to full device control.
NVD Description
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been…
more
published and may be used.
Deeper analysisAI
CVE-2026-3378 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda F453 routers on firmware version 1.0.0.3. The issue lies in the fromqossetting function of the /goform/qossetting file, where manipulation of the qos argument triggers the overflow. Published on 2026-03-01, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, requiring no user interaction. Successful attacks can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution via the buffer overflow.
Advisories from VulDB (ctiid.348263, id.348263, submit.759625) and a GitHub repository (Litengzheng/vul_db/blob/main/F453/vul_78/README.md) detail the flaw, with a published exploit available for use. The Tenda vendor website (www.tenda.com.cn) is referenced for potential mitigation guidance.
Details
- CWE(s)