CVE-2026-4551
Published: 22 March 2026
Summary
CVE-2026-4551 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4551 is a stack-based buffer overflow vulnerability affecting Tenda F453 routers on firmware version 1.0.0.3. The flaw resides in the fromSafeClientFilter function within the /goform/SafeClientFilter file of the Parameters Handler component. It is triggered by manipulating the menufacturer/Go argument, as associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability was published on 2026-03-22 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L) but no user interaction. An attacker meeting these conditions can achieve high impacts on confidentiality, integrity, and availability, potentially enabling remote code execution via the buffer overflow.
Advisories and details are available via VulDB entries at https://vuldb.com/?ctiid.352378, https://vuldb.com/?id.352378, and https://vuldb.com/?submit.774929, along with the vendor site at https://www.tenda.com.cn/. A public exploit is documented at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_86/README.md and could be used.
The exploit has been made public, increasing the risk for unpatched Tenda F453 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14312
Vulnerability details
A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go results in stack-based buffer overflow. The attack is possible to…
more
be carried out remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the web form handler (/goform/SafeClientFilter) of a network device's public management interface directly enables remote exploitation for initial access and RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs like the menufacturer/Go argument to prevent stack-based buffer overflows from improper restriction of operations within memory bounds.
Implements memory protections such as stack canaries, address space layout randomization, and non-executable memory to mitigate exploitation of stack-based buffer overflows.
Mandates timely flaw remediation through firmware patching to address the specific stack buffer overflow vulnerability in Tenda F453 firmware.