CVE-2026-3768
Published: 08 March 2026
Summary
CVE-2026-3768 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3768 is a stack-based buffer overflow vulnerability affecting the Tenda F453 router on firmware version 1.0.0.3. The flaw resides in the formWrlExtraSet function within the /goform/WrlExtraSet file, where manipulation of the GO argument triggers the overflow. Published on 2026-03-08, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 8.8.
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U). Successful exploitation enables remote code execution, as the issue supports remote attacks.
VulDB advisories detail the vulnerability under identifiers like ctiid.349746 and id.349746, with a proof-of-concept exploit publicly disclosed on GitHub at Litengzheng/vul_db. Practitioners should review the Tenda website and referenced sources for firmware patches or mitigation guidance.
The exploit disclosure increases the risk of active use against unpatched Tenda F453 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10271
Vulnerability details
A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. The manipulation of the argument GO leads to stack-based buffer overflow. Remote exploitation of the attack is possible.…
more
The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web form (/goform/WrlExtraSet) enables remote exploitation of a public-facing application for RCE; post-exploit command execution occurs via Unix shell on the embedded device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow vulnerability by identifying, patching, and updating the affected Tenda F453 firmware version 1.0.0.3.
Enforces validation of the GO argument in the /goform/WrlExtraSet web form handler to prevent the improper restriction of operations leading to buffer overflow.
Implements memory safeguards such as stack canaries, ASLR, or DEP to protect against remote code execution from the stack buffer overflow exploitation.