Tenda EUVD-2026-16963

Attacker requires authenticated access (PR:L) to Tenda F453 router running firmware version 1.0.0.3. Exploit targets the /goform/PPTPUserSetting endpoint in httpd via crafted 'delno' parameter to trigger stack-based buffer overflow.

Real-world risk is moderate-to-high for internet-exposed devices with default or weak credentials. CVSS 8.8 indicates critical severity with network attack vector (AV:N) and low complexity (AC:L), but the requirement for low-privileged authentication (PR:L) significantly constrains the attack surface compared to unauthenticated RCE. The CVSS environmental metrics show Proof-of-concept code exists (E:P), which aligns with the confirmed publicly available exploit on GitHub. No CISA KEV listing or EPSS score provided, suggesting no confirmed active exploitation campaigns at time of analysis. However, home/SOHO routers frequently have weak admin credentials and exposed management interfaces, making authenticated access a low barrier for opportunistic attackers. The combination of public exploit code, network accessibility, and Tenda's consumer router market position creates realistic exploitation scenarios. SSVC considerations: exploitation is proven (POC exists), likely automatable given the simple parameter manipulation, technical impact is total system compromise. Primary risk mitigation is that many Tenda F453 deployments may not expose management interfaces to WAN by default.

An attacker identifies a Tenda F453 router with firmware 1.0.0.3 exposing its web management interface on the internet or compromises a network with LAN access. Using credential stuffing with common default credentials (admin/admin) or previously compromised credentials, the attacker authenticates to the router's admin panel. They then craft a malicious HTTP POST request to /goform/PPTPUserSetting with an oversized 'delno' parameter value designed to overflow the stack buffer in fromPPTPUserSetting. The overflow overwrites the return address, redirecting execution to attacker-supplied shellcode that establishes persistent backdoor access, modifies DNS settings to redirect traffic through attacker-controlled servers, or pivots to attack other devices on the internal network. The publicly available GitHub POC provides a working exploitation framework, requiring minimal technical expertise to weaponize.