Which versions of Tenda are affected by CVE-2026-4553?

A critical remote code execution vulnerability affects Tenda F453 routers with no available patch, allowing authenticated attackers to completely compromise affected devices.

Is there a public PoC exploit available for CVE-2026-4553?

Yes, a public proof-of-concept exploit is available for CVE-2026-4553. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4553?

Within 24 hours: Inventory all Tenda F453 routers in production and restrict network access to the /goform/Natlimit endpoint via firewall rules. Within 7 days: Evaluate replacement hardware or alternative network appliances from vendors with active security support; implement enhanced network monitoring for suspicious activity on affected devices. Within 30 days: Complete migration away from vulnerable F453 devices or implement compensating controls including WAF rules, network segmentation isolating affected routers, and disable Natlimit functionality if operationally feasible.

Tenda CVE-2026-4553

Q: What is the CVSS score of CVE-2026-4553?

CVE-2026-4553 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14317 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-22 VulDB

GHSA-7xjm-vrcp-p3wm

Buffer Overflow Tenda Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 20:50 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 15:45 euvd

EUVD-2026-14317

Analysis Generated

Mar 22, 2026 - 15:45 vuln.today

CVE Published

Mar 22, 2026 - 15:24 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Tenda F453 1.0.0.3 contains a stack-based buffer overflow in the Natlimit parameter handler that allows authenticated remote attackers to achieve full system compromise through a malicious page argument. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials can trigger the overflow to execute arbitrary code with high integrity and confidentiality impact.

Technical ContextAI

This vulnerability affects the Tenda F453 router (CPE: cpe:2.3:a:tenda:f453:*:*:*:*:*:*:*:*) in the parameters handling component responsible for NAT limit configuration. The root cause is CWE-121 (Stack-based Buffer Overflow), occurring when the fromNatlimit function in the /goform/Natlimit handler fails to properly validate the length of the 'page' argument before copying it to a fixed-size stack buffer. Stack-based buffer overflows are particularly dangerous in embedded devices like routers because they can lead to arbitrary code execution by overwriting the return address on the stack, allowing attackers to hijack program control flow and execute malicious shellcode with the privileges of the web server process, typically running as root on such devices.

RemediationAI

No official patch or firmware update is referenced in the available intelligence sources, so users should immediately check the Tenda website at https://www.tenda.com.cn/ for any available firmware updates beyond version 1.0.0.3 and apply them if available. Until a patch is confirmed available, implement defense-in-depth measures including disabling remote administration interfaces, restricting web interface access to trusted IP addresses only through firewall rules, changing default administrative credentials to strong unique passwords, and placing affected routers behind additional network segmentation or a more secure gateway device. Organizations with critical security requirements should consider replacing affected Tenda F453 devices with alternative router models from vendors with stronger security track records and more responsive patch management processes. Monitor vendor communications and VulDB updates for patch availability information.