Which versions of Tenda are affected by CVE-2026-4552?

A critical vulnerability in Tenda F453 routers enables authenticated attackers to execute arbitrary code, steal data, or crash devices through a publicly available exploit.

Is there a public PoC exploit available for CVE-2026-4552?

Yes, a public proof-of-concept exploit is available for CVE-2026-4552. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4552?

Within 24 hours: Identify all Tenda F453 devices running firmware 1.0.0.3 in your environment and isolate them from critical network segments. Within 7 days: Implement compensating controls including network access restrictions, disable the VirtualSer feature if operationally feasible, and deploy WAF rules blocking /goform/VirtualSer requests. Within 30 days: Replace affected routers with patched firmware versions when available, or migrate to alternative equipment from vendors with active security support.

Tenda CVE-2026-4552

Q: What is the CVSS score of CVE-2026-4552?

CVE-2026-4552 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14313 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-22 VulDB

GHSA-hwc3-99fx-qcgr

Buffer Overflow Tenda Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 20:50 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 14:45 euvd

EUVD-2026-14313

Analysis Generated

Mar 22, 2026 - 14:45 vuln.today

CVE Published

Mar 22, 2026 - 14:31 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in Tenda F453 firmware version 1.0.0.3 allows remote attackers to achieve complete system compromise through manipulation of the page parameter in the VirtualSer handler. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with network access can execute arbitrary code with high impact on confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the Tenda F453 wireless router (cpe:2.3:a:tenda:f453:*:*:*:*:*:*:*:*) running firmware version 1.0.0.3. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the Parameters Handler component when processing the VirtualSer function. Stack-based buffer overflows occur when data is written beyond the allocated stack buffer boundary, potentially overwriting return addresses or other critical memory structures. The vulnerable endpoint is /goform/VirtualSer, which appears to handle virtual server configuration settings. The 'page' parameter lacks proper bounds checking, allowing an attacker to inject excessive data that corrupts the stack memory space.

RemediationAI

Users of Tenda F453 routers running firmware 1.0.0.3 should immediately check the vendor website at https://www.tenda.com.cn/ for updated firmware versions that address this vulnerability and apply patches as soon as available. Until patching is possible, implement defense-in-depth mitigations including: disable remote administration access to the router web interface, restrict management interface access to trusted internal network segments only via firewall rules, change default administrative credentials to strong unique passwords, and monitor for unusual activity targeting the /goform/VirtualSer endpoint. Consider replacing the device if the vendor does not provide security updates, as publicly available exploits significantly increase risk exposure.