CVE-2026-4554
Published: 22 March 2026
Description
A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The…
more
exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the 'mac' argument to neutralize special elements in the FormWriteFacMac function.
Addresses the root cause by identifying, prioritizing, and remediating the specific command injection flaw in Tenda F453 firmware version 1.0.0.3.
Monitors system activity to detect indicators of command injection exploitation, such as anomalous command executions from low-privileged remote access.
Security SummaryAI
CVE-2026-4554 is a command injection vulnerability affecting Tenda F453 firmware version 1.0.0.3. The flaw resides in the FormWriteFacMac function within the /goform/WriteFacMac file, where the 'mac' argument can be manipulated to inject arbitrary commands. Associated with CWE-74 (Improper Neutralization of Special Elements), CWE-77 (Command Injection variant), and CWE-78 (OS Command Injection), it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.
The vulnerability enables remote exploitation by attackers who possess low privileges, such as authenticated users on the device. By crafting a malicious 'mac' parameter, an attacker can execute arbitrary system commands, potentially leading to limited impacts on confidentiality, integrity, and availability, including data leakage, modification of device settings, or denial of service.
References from VulDB detail the issue and submission process, while a GitHub repository contains a publicly released exploit for the Tenda F453. The vendor's site at tenda.com.cn is listed, though no specific patches or mitigations are detailed in available information; practitioners should monitor it for firmware updates.
Notable context includes the public availability of the exploit, increasing the risk of real-world attacks against unpatched Tenda F453 devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router firmware web interface enables exploitation of public-facing application (T1190) and arbitrary OS command execution via Unix Shell (T1059.004) or Network Device CLI (T1059.008).