Cyber Posture

CVE-2026-3167

HighPublic PoC

Published: 25 February 2026

Published
25 February 2026
Modified
25 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Tenda F453 1.0.0.3. The impacted element is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component httpd. Performing a manipulation of the argument webSiteId results in buffer overflow. The attack may be…

more

initiated remotely. The exploit has been released to the public and may be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation directly addresses the buffer overflow vulnerability by applying vendor patches or firmware updates to the Tenda F453 httpd component.

prevent

Information input validation enforces proper bounds checking on the webSiteId argument in the formWebTypeLibrary function, preventing the buffer overflow exploitation.

prevent

Memory protection mechanisms such as address space layout randomization and data execution prevention mitigate arbitrary code execution from the buffer overflow in the httpd component.

Security SummaryAI

CVE-2026-3167 is a buffer overflow vulnerability affecting the Tenda F453 router running firmware version 1.0.0.3. The flaw resides in the formWebTypeLibrary function within the /goform/webtypelibrary endpoint of the httpd component. It is triggered by manipulating the webSiteId argument, leading to improper bounds checking as associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The vulnerability was published on 2026-02-25 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.

Advisories and additional details are available through references including a GitHub repository at https://github.com/Litengzheng/vul_db/blob/main/F453/vul_66/README.md, multiple VulDB entries at https://vuldb.com/?ctiid.347674, https://vuldb.com/?id.347674, and https://vuldb.com/?submit.759594, and the vendor site at https://www.tenda.com.cn/. These sources may provide guidance on patches or mitigations, though specific remediation steps are not detailed here.

The exploit for CVE-2026-3167 has been publicly released, increasing the risk of active attacks against unpatched Tenda F453 devices.

Details

CWE(s)

Affected Products

tenda
f453 firmware
1.0.0.3

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a buffer overflow in the web management interface (httpd /goform/webtypelibrary) of a public-facing router, enabling remote exploitation for arbitrary code execution, directly mapping to Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References