CVE-2026-3380
Published: 01 March 2026
Summary
CVE-2026-3380 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the buffer overflow by requiring timely remediation through patching the vulnerable frmL7ImForm function in Tenda F453 firmware.
Requires validation of the 'page' argument to prevent buffer overflow exploitation in the /goform/L7Im endpoint.
Implements memory safeguards like address space layout randomization and stack canaries to mitigate buffer overflow exploits even if invalid input reaches the function.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web form (/goform/) enables remote exploitation of public-facing application for initial access (T1190) and directly supports privilege escalation from authenticated low-priv user to full compromise (T1068).
NVD Description
A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public…
more
and could be used.
Deeper analysisAI
CVE-2026-3380 is a buffer overflow vulnerability affecting the Tenda F453 router on firmware version 1.0.0.3. The flaw exists in the frmL7ImForm function of the /goform/L7Im file, where manipulation of the "page" argument triggers the overflow. Classified under CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-01.
The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, such as those held by an authenticated user, with no user interaction needed. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise. An exploit has been made public and could be used.
Advisories and additional details are available via VulDB entries and a GitHub repository containing exploit information, along with the vendor's site at tenda.com.cn. Practitioners should review these references for any patch or mitigation guidance.
Details
- CWE(s)