CVE-2026-5021
Published: 29 March 2026
Summary
CVE-2026-5021 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda F453 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating the stack buffer overflow in the fromPPTPUserSetting function of the httpd component directly eliminates the vulnerability exploitable via the delno argument.
Validating the delno argument at the /goform/PPTPUserSetting input point prevents the stack-based buffer overflow triggered by malicious manipulation.
Implementing memory protections like stack canaries, ASLR, and non-executable memory directly mitigates stack-based buffer overflow exploitation in the httpd component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the authenticated web endpoint (/goform/PPTPUserSetting) of the router's httpd process directly enables remote code execution. This maps to T1190 (exploiting the public-facing web application), T1068 (privilege escalation from low-priv web session to root/code exec), and T1059.004 (Unix shell command execution on the embedded Linux firmware).
NVD Description
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit has been published and may be used.
Deeper analysisAI
CVE-2026-5021 is a stack-based buffer overflow vulnerability affecting the Tenda F453 router on firmware version 1.0.0.3. The issue lies in the fromPPTPUserSetting function within the /goform/PPTPUserSetting file of the httpd component. Manipulation of the delno argument triggers the overflow, as documented in the CVE description published on 2026-03-29.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 119, 121, and 787. Remote exploitation is possible over the network with low attack complexity, requiring low privileges but no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially enabling remote code execution.
Advisories and references include a GitHub repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_92/README.md publishing an exploit that may be used, along with VulDB entries at https://vuldb.com/vuln/353906 and related pages. The vendor site https://www.tenda.com.cn/ is listed, though specific patch or mitigation details are not provided in the CVE data.
The published exploit underscores active interest in this flaw, increasing the risk for unpatched Tenda F453 devices.
Details
- CWE(s)