Which versions of Tenda are affected by CVE-2026-4551?

Tenda F453 routers are vulnerable to remote code execution attacks by authenticated users, with public exploits now available.

Is there a public PoC exploit available for CVE-2026-4551?

Yes, a public proof-of-concept exploit is available for CVE-2026-4551. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4551?

Within 24 hours: Identify all Tenda F453 devices in your network and isolate them from critical systems; disable remote management access and restrict administrative accounts. Within 7 days: Implement WAF rules to block requests to /goform/SafeClientFilter endpoint and monitor for exploitation attempts; enforce network segmentation to limit router access. Within 30 days: Evaluate replacement with patched router models from alternative vendors; develop migration plan and execute upgrades for all affected devices.

Tenda CVE-2026-4551

Q: What is the CVSS score of CVE-2026-4551?

CVE-2026-4551 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14312 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-22 VulDB

GHSA-2mxw-7frq-fx3r

Buffer Overflow Tenda Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 20:50 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 14:45 euvd

EUVD-2026-14312

Analysis Generated

Mar 22, 2026 - 14:45 vuln.today

CVE Published

Mar 22, 2026 - 14:31 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Tenda F453 version 1.0.0.3 contains a stack-based buffer overflow in the SafeClientFilter parameter handler that allows authenticated remote attackers to execute arbitrary code by manipulating the manufacturer/Go argument. Public exploit code exists for this vulnerability and no patch is currently available, creating significant risk for affected deployments.

Technical ContextAI

The vulnerability affects the Tenda F453 router (CPE: cpe:2.3:a:tenda:f453:*:*:*:*:*:*:*:*) running firmware version 1.0.0.3. This is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption vulnerability that occurs when a program writes more data to a buffer located on the stack than it was allocated to hold. The affected function fromSafeClientFilter in the /goform/SafeClientFilter endpoint of the Parameters Handler component fails to properly validate input length for the 'menufacturer' and 'Go' parameters. When these parameters are manipulated with oversized input, they overflow the allocated stack buffer, potentially overwriting return addresses, function pointers, or other critical stack data. This class of vulnerability can lead to arbitrary code execution as the attacker can control the instruction pointer by carefully crafting the overflow payload to redirect program execution to malicious code.

RemediationAI

As of this analysis, no official patch or firmware update has been explicitly referenced in the available intelligence sources, indicated by the CVSS Remediation Level of 'X' (unavailable). Users of Tenda F453 firmware version 1.0.0.3 should immediately check the official Tenda website at https://www.tenda.com.cn/ for any available firmware updates that address this vulnerability and apply them as soon as possible. Until an official patch is available or can be deployed, implement the following mitigations: disable remote management interfaces and restrict administrative access to the router to trusted local network segments only, enforce strong non-default administrative credentials to raise the privilege requirement bar, consider deploying the affected devices behind additional network segmentation or firewall controls to limit exposure, and if the SafeClientFilter functionality is not required for operations, disable it if possible through the router's configuration interface. Organizations should also monitor VulDB entries https://vuldb.com/?id.352378 and the GitHub repository https://github.com/Litengzheng/vul_db/blob/main/F453/vul_86/README.md for updates on exploitation activity and potential workarounds.