Tenda CVE-2026-4551

Authenticated access to Tenda F453 1.0.0.3 router. Attacker must send crafted POST request to /goform/SafeClientFilter endpoint with malicious manufacturer/Go parameter. No user interaction required. Public exploit available.

This vulnerability presents a high real-world risk despite requiring low-level authentication. The CVSS v3.1 score of 8.8 reflects the severity accurately: network attack vector (AV:N) enables remote exploitation, low attack complexity (AC:L) means no special conditions are required, low privileges (PR:L) indicates only basic authentication is needed, and the impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H). The exploit maturity level is marked as Proof-of-concept (E:P), and a functional exploit is publicly available on GitHub, significantly increasing the likelihood of exploitation. While no EPSS score or KEV status is provided in the available data, the combination of public exploit code, network accessibility, and critical impact to home/SOHO router infrastructure makes this a genuine priority for remediation. The attack requires only low privileges, which in many Tenda router deployments may be achievable through default credentials or weak passwords commonly found in consumer networking equipment. This is not a theoretical risk but an immediately actionable vulnerability for threat actors targeting internet-facing routers.

An attacker scans the internet for Tenda F453 routers with exposed management interfaces and identifies devices running the vulnerable firmware version 1.0.0.3. After gaining low-privilege authentication through default credentials, credential stuffing, or a separate authentication bypass, the attacker crafts a malicious HTTP request to the /goform/SafeClientFilter endpoint with an oversized payload in the 'menufacturer' or 'Go' parameter, triggering the stack-based buffer overflow in the fromSafeClientFilter function. By carefully constructing the overflow payload using techniques documented in the publicly available proof-of-concept exploit on GitHub, the attacker overwrites the return address on the stack to redirect execution to injected shellcode, gaining arbitrary code execution with the privileges of the web server process and potentially achieving full router compromise to establish persistent access, pivot to internal network resources, or enlist the device in a botnet.