Tenda F453 Router: Remote Code Execution via Malicious Input

Summary

A security flaw in the Tenda F453 router's httpd component allows an attacker to inject malicious code remotely. This could result in unauthorized access to the router. Tenda has not yet released a patch to fix this issue, so users should be cautious when accessing the router's web interface.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	f453_firmware	1.0.0.3	–

Original title

A security flaw has been discovered in Tenda F453 1.0.0.3. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Performing a manipulation of the a...

Original description

A security flaw has been discovered in Tenda F453 1.0.0.3. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Performing a manipulation of the argument page results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-120 Classic Buffer Overflow

https://github.com/Litengzheng/vul_db/blob/main/F453/vul_74/README.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.347998 Permissions Required VDB Entry
https://vuldb.com/?id.347998 Third Party Advisory VDB Entry
https://vuldb.com/?submit.759621 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product