Tenda CVE-2026-4553

Requires authenticated access to Tenda F453 router firmware version 1.0.0.3. Attacker must be logged into the web administration interface to access the /goform/Natlimit endpoint and manipulate the 'page' parameter to trigger the stack-based buffer overflow.

This vulnerability presents significant real-world risk despite requiring low-level authentication (PR:L). The CVSS v3.1 score of 8.8 is well-justified given the network attack vector (AV:N), low attack complexity (AC:L), no user interaction required (UI:N), and complete impact across all CIA triad elements (C:H/I:H/A:H). The public availability of a working proof-of-concept exploit on GitHub dramatically increases exploitation likelihood, as attackers can leverage existing code rather than developing exploits from scratch. The fact that this affects a consumer router with no apparent patch available from Tenda (vendor homepage listed but no security advisory referenced) means vulnerable devices will likely remain exposed indefinitely. Authentication requirements provide minimal protection since many Tenda routers ship with default credentials that users rarely change. This should be considered a genuine priority for organizations using affected hardware, particularly given that routers are attractive targets for establishing persistent network footholds and pivoting to internal resources.

An attacker on the internet or local network obtains valid credentials for the Tenda F453 web interface through credential stuffing with default passwords (admin/admin being common on Tenda devices) or through phishing. The attacker then sends a specially crafted HTTP request to the /goform/Natlimit endpoint with an oversized 'page' parameter value designed to overflow the stack buffer, as demonstrated in the public GitHub proof-of-concept at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_88/README.md. By carefully controlling the overflow data, the attacker overwrites the return address to redirect execution to injected shellcode, gaining root-level command execution on the router and establishing persistent access for network surveillance, traffic interception, or lateral movement to other devices on the network.