Publicly Exploitable Buffer Overflows Disclosed in Tenda FH451 and F453 Routers

Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting FH451 1.0.0.9 and F453 1.0.0.3. The flaws are tracked as CVE-2026-4534 and CVE-2026-4552 and both involve remotely reachable stack-based buffer overflows in web management handlers. In the FH451 case, the issue is in the formWrlExtraSet function exposed through the /goform/WrlExtraSet component, where manipulation of the GO argument can trigger memory corruption. In the F453 case, the vulnerable code is the fromVirtualSer function behind the /goform/VirtualSer endpoint, where the page argument can be abused to cause a similar overflow.

Both CVE records indicate that public exploits are available, increasing the likelihood of opportunistic attacks against exposed devices. The disclosures map the weaknesses to CWE-119 and CWE-121, reflecting out-of-bounds memory handling and stack-based buffer overflow conditions, and the published scoring points to high impact on confidentiality, integrity, and availability. Organizations using these Tenda models should treat the flaws as urgent remote compromise risks, especially where router administration interfaces are internet-accessible.