CVE-2026-3378
Published: 01 March 2026
Description
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been…
more
published and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the buffer overflow by requiring validation of the manipulated qos argument in the /goform/qossetting function.
Requires timely remediation of the specific buffer overflow flaw through firmware updates for the Tenda F453 1.0.0.3.
Provides memory protections like stack guards or ASLR to mitigate exploitation of the buffer overflow even if input validation fails.
Security SummaryAI
CVE-2026-3378 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda F453 routers on firmware version 1.0.0.3. The issue lies in the fromqossetting function of the /goform/qossetting file, where manipulation of the qos argument triggers the overflow. Published on 2026-03-01, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, requiring no user interaction. Successful attacks can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution via the buffer overflow.
Advisories from VulDB (ctiid.348263, id.348263, submit.759625) and a GitHub repository (Litengzheng/vul_db/blob/main/F453/vul_78/README.md) detail the flaw, with a published exploit available for use. The Tenda vendor website (www.tenda.com.cn) is referenced for potential mitigation guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow RCE in public router web form (/goform/qossetting) directly enables T1190 (exploit public-facing app) for remote access and T1068 (exploitation for privilege escalation) from low-priv web account to full device control.