Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
A stack-based buffer overflow vulnerability exists in Tenda F453 firmware version 1.0.0.3. The vulnerability is located in the fromNatlimit function of the /goform/Natlimit component (Parameters Handler). The vulnerability can be exploited by manipulating the "page" argument, which leads to a stack-based buffer overflow condition.
This vulnerability allows authenticated attackers with low privileges to remotely exploit the device. Successful exploitation could result in complete compromise of system confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code, modify system files, or cause denial of service. The attack requires network access and low-level authentication credentials but does not require user interaction.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch information is not available at this time. Monitor vendor advisories for firmware updates.
1. Prioritize patching of Tenda F453 devices running firmware version 1.0.0.3 as this is a HIGH severity vulnerability with CVSS 3.1 score of 8.8 and CVSS 4.0 score of 7.4. 2. Restrict network access to the device's web interface and /goform/Natlimit endpoint to only trusted networks and authorized users. 3. Implement network segmentation to limit exposure of affected devices. 4. Monitor for suspicious access patterns to the /goform/Natlimit endpoint. 5. Disable remote management features if not required. 6. Check the Tenda vendor security advisory channels for firmware patches and upgrade devices immediately upon availability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-4553 . See article
NVD published the first details for CVE-2026-4553
A CVSS base score of 8.8 has been assigned.
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
