Tenda CVE-2026-4552

Requires authenticated access to Tenda F453 router running firmware version 1.0.0.3. Attacker must have valid login credentials to access the /goform/VirtualSer endpoint and manipulate the 'page' parameter to trigger stack-based buffer overflow. Remote exploitation requires prior authentication.

The CVSS score of 8.8 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), and requirement for low-privilege authentication (PR:L). All three CIA impact ratings are High, indicating potential for complete system compromise. The critical risk factor is the publicly available exploit code on GitHub (https://github.com/Litengzheng/vul_db/blob/main/F453/vul_87/README.md), which dramatically increases the likelihood of exploitation by lowering technical barriers. The CVSS temporal metrics show Exploit Maturity as Proof-of-concept (E:P), confirming demonstrable exploit code exists. While authentication is required (PR:L), many IoT devices use default or weak credentials, making this requirement minimal in practice. The combination of public exploit availability, network accessibility, and high impact makes this a real-world priority requiring immediate attention, particularly for internet-facing deployments.

An attacker who has obtained low-privilege credentials (through credential stuffing, default passwords, or prior reconnaissance) connects to the Tenda F453 router's web management interface over the network. They send a crafted HTTP request to the /goform/VirtualSer endpoint with an oversized 'page' parameter value designed to overflow the stack buffer. This overwrites critical memory structures, allowing the attacker to execute arbitrary code with the privileges of the web server process, potentially gaining full control of the router to intercept traffic, modify DNS settings, or pivot to internal network resources. The attack is straightforward given the publicly available proof-of-concept code on GitHub.