VulnerabilityAnalyzed
CVE-2026-4554
The manipulation of the argument mac results in command injection.
LOW 2.1EPSS 3.75%
Does this matter?
Lower severity and a low EPSS score (3.75%). Track it; it rarely justifies an emergency change on its own.
Description
A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.75% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77, CWE-78
- Affected
- tenda/f453 firmware
- Source
- cna@vuldb.com
References
- https://github.com/Litengzheng/vul_db/blob/main/F453/vul_95/README.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.352381Permissions Required, VDB Entry
- https://vuldb.com/?id.352381Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.774933Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.