Which versions of Tenda are affected by CVE-2026-5021?

CVE-2026-5021 is a high-severity stack buffer overflow in Tenda F453 router firmware (version 1.0.0.3) that allows authenticated attackers to execute arbitrary code or disable the device through the…

Is there a public PoC exploit available for CVE-2026-5021?

Yes, a public proof-of-concept exploit is available for CVE-2026-5021. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5021?

Within 24 hours: Inventory all Tenda F453 devices running firmware 1.0.0.3 and disable remote management access (PPTP configuration interface) or restrict access via network segmentation. Within 7 days: Apply the strongest available firmware update from Tenda if available above version 1.0.0.3; if no newer version exists, implement firewall rules to block access to the httpd management port (typically 80/443) from untrusted networks. Within 30 days: Replace Tenda F453 units with alternative router models from vendors with active security support, or isolate affected devices to management-only VLANs with strict access controls.

Tenda CVE-2026-5021

Q: What is the CVSS score of CVE-2026-5021?

CVE-2026-5021 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16963 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-29 VulDB

GHSA-pcxg-4cp2-qqj4

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 19:01 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 01:30 euvd

EUVD-2026-16963

Analysis Generated

Mar 29, 2026 - 01:30 vuln.today

CVE Published

Mar 29, 2026 - 01:15 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda F453 router firmware 1.0.0.3 allows authenticated remote attackers to execute arbitrary code or crash the device via the PPTP user configuration interface. The vulnerability resides in the fromPPTPUserSetting function within the httpd component, triggered by manipulating the 'delno' parameter. Publicly available exploit code exists (GitHub), significantly lowering exploitation barriers. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though authentication is required (PR:L). EPSS data not provided, but public POC availability elevates real-world risk for exposed management interfaces.

Technical ContextAI

This vulnerability affects the httpd web server component of Tenda F453 wireless router firmware version 1.0.0.3, specifically within the PPTP VPN user management functionality at endpoint /goform/PPTPUserSetting. The flaw is a classic CWE-121 stack-based buffer overflow occurring in the fromPPTPUserSetting function when processing the 'delno' parameter. Stack-based buffer overflows occur when input data exceeds the allocated buffer size on the program stack, allowing attackers to overwrite adjacent memory including return addresses and function pointers. In embedded router firmware like Tenda's, these components typically run with elevated privileges, making successful exploitation particularly impactful. The httpd daemon processes administrative web interface requests, and PPTP configuration functions typically handle user credential management for VPN access.

RemediationAI

Users should immediately check their Tenda F453 firmware version via the router's web interface and monitor the official Tenda support portal at https://www.tenda.com.cn/ for security updates addressing CVE-2026-5021. No vendor-released patch version has been independently confirmed from available data at time of analysis, so users should check VulDB tracking at https://vuldb.com/vuln/353906 for remediation status updates. As interim risk mitigation: restrict access to the router's administrative interface to trusted local networks only by disabling remote/WAN management features, implement strong administrative credentials if defaults are in use, and consider network segmentation to isolate the router from critical network assets. Organizations using Tenda F453 in production environments should evaluate replacement with enterprise-grade networking equipment that receives regular security updates. Monitor the GitHub POC repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_92/README.md to understand attack indicators for detection purposes.