CVE-2026-3166
Published: 25 February 2026
Description
A vulnerability was identified in Tenda F453 1.0.0.3. The affected element is the function fromRouteStatic of the file /goform/RouteStatic of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The…
more
exploit is publicly available and might be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow flaw in the fromRouteStatic function of the httpd component by identifying, reporting, and applying patches.
Validates the 'page' argument to prevent manipulation that triggers the buffer overflow in /goform/RouteStatic.
Implements memory safeguards such as ASLR and DEP to mitigate arbitrary code execution or crashes from the buffer overflow vulnerability.
Security SummaryAI
CVE-2026-3166 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting the Tenda F453 router on firmware version 1.0.0.3. The flaw exists in the fromRouteStatic function within the /goform/RouteStatic file of the httpd component, where manipulation of the "page" argument triggers the overflow.
The vulnerability enables remote exploitation by an attacker possessing low privileges (PR:L), with low attack complexity over the network (AV:N/AC:L/UI:N). Its CVSS v3.1 base score of 8.8 (C:H/I:H/A:H/S:U) indicates high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system crashes. A public exploit is available and might be used.
Advisories provide details via VulDB entries (ctiid.347673, id.347673, submit.759589) and a GitHub repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_65/README.md containing exploit information. The vendor site https://www.tenda.com.cn/ is referenced, though specific patch or mitigation guidance is not detailed in the disclosure.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router httpd web interface (fromRouteStatic, 'page' param) enables remote unauthenticated/low-priv RCE over network, directly mapping to exploitation of public-facing applications for initial access.