Is there a public PoC exploit available for EUVD-2026-25665?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25665. Prioritise patching immediately. EPSS: 0.7%.

Tenda F453 EUVD-2026-25665

Q: What is the CVSS score of EUVD-2026-25665?

EUVD-2026-25665 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-6989 LOW

Command Injection (CWE-77)

2026-04-25 VulDB

Tenda Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:10 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 25, 2026 - 18:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 18:00 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 17:45 euvd

EUVD-2026-25665

Analysis Generated

Apr 25, 2026 - 17:45 vuln.today

CVE Published

Apr 25, 2026 - 17:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in Tenda F453 up to 1.0.0.3. Impacted is the function TendaTelnet of the file /goform/telnet of the component Telnet Service. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Command injection in Tenda F453 firmware up to version 1.0.0.3 allows authenticated remote attackers to execute arbitrary system commands via the TendaTelnet function in the /goform/telnet endpoint. The vulnerability has publicly available exploit code and may be actively used against deployed devices. Attack requires low-privilege authentication but carries significant risk due to the telnet service's direct command execution capability.

Technical ContextAI

The vulnerability exists in the Telnet Service component of Tenda F453 routers, specifically in the TendaTelnet function handling requests to /goform/telnet. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating insufficient input validation or sanitization of user-supplied parameters before they are passed to system command execution routines. Telnet services typically execute shell commands directly, making command injection particularly severe. The vulnerability affects Tenda F453 devices running firmware version 1.0.0.3 and earlier versions as identified by the provided CPE.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires disabling or restricting access to the Telnet Service component if not essential for device operation - this can typically be done through the router's web administration interface under service settings, though this approach assumes the legitimate administrator can access the router before exploitation. More robust interim control: restrict network access to the /goform/telnet endpoint using firewall rules or access control lists to allow connections only from trusted administrative networks, blocking general user access. If Telnet must remain enabled, enforce strong administrative credentials and change default passwords immediately. Monitor for firmware updates from Tenda at https://www.tenda.com.cn/ and apply as soon as patched versions become available. As a longer-term measure, consider replacing F453 units with devices receiving active security updates, as this older model may not receive timely patches.