Tenda 4G300 EUVD-2026-26307

Attacker must possess valid administrative credentials for the Tenda 4G300 web management interface - exploitation requires authenticated access (CVSS PR:L). The vulnerable /goform/SafeMacFilter endpoint is part of the standard web administration interface and requires no special feature enablement beyond default configuration. Once authenticated, no user interaction is required (CVSS UI:N) to trigger the buffer overflow via crafted HTTP requests. The vulnerability is exploitable against any Tenda 4G300 router running firmware version US_4G300V1.0Mt_V1.01.42_CN_TDC01 with web management enabled (default configuration). Limiting factors: authentication requirement reduces attack surface compared to unauthenticated RCE, though weak/default credentials are common in consumer routers; network accessibility depends on whether remote administration is enabled on WAN interface or device is LAN-only accessible; stack protection mechanisms (ASLR, DEP, stack canaries) are typically absent or weak in embedded device firmware, facilitating reliable exploitation once memory layout is known.

Real-world risk is MODERATE-to-HIGH for environments using this specific Tenda router model. The CVSS base score of 7.4 accurately reflects the technical severity - complete device compromise (VC:H/VI:H/VA:H) with network attack vector. However, exploitation requires authenticated access (PR:L), meaning attackers need valid router credentials before triggering the overflow. The existence of public exploit code (GitHub PoC, VulDB reference vuln/360206) significantly lowers the skill barrier, enabling script-kiddie exploitation against routers with weak/default credentials. Attack complexity is low (AC:L) - once authenticated, triggering the overflow requires only a malformed HTTP request to a documented endpoint. No EPSS score or CISA KEV status is provided in the data, suggesting limited evidence of widespread automated scanning or active exploitation campaigns as of this analysis. The primary attack vector is credential-based compromise (brute force, default passwords, credential stuffing) followed by privilege escalation via buffer overflow. Organizations using Tenda 4G300 routers should prioritize this based on: (1) whether devices are internet-facing, (2) strength of administrative passwords, and (3) availability of vendor patches. Consumer/SOHO routers rarely receive timely security updates, making replacement often more viable than remediation.

An attacker discovers a Tenda 4G300 router exposed on the internet via Shodan scanning, identifying it by HTTP banner fingerprinting or default login page characteristics. Using credential stuffing attacks with common default passwords (admin/admin) or brute-forcing weak credentials, the attacker gains authenticated access to the web management interface. Once authenticated, the attacker leverages the public GitHub exploit code (Axelioc/CVE) to send a crafted HTTP POST request to /goform/SafeMacFilter with an oversized 'page' parameter value. This triggers the stack-based buffer overflow in function sub_427C3C, overwriting the return address to redirect execution to attacker-controlled shellcode embedded in the request. The shellcode executes with router firmware privileges, establishing persistent backdoor access via modified firewall rules or installing a remote access trojan, enabling ongoing network surveillance and lateral movement within the victim's internal network.