CVE-2026-3271 is a high severity buffer overflow in the Tenda F453 router, firmware 1.0.0.3, scored CVSS 8.8. The page argument of the fromP2pListFilter function overflows a buffer, and NVD says an exploit is public. I could not confirm a fixed firmware, so limit access and check Tenda support.
What's affected
The NVD record names Tenda F453 firmware 1.0.0.3, the function fromP2pListFilter, the file /goform/P2pListFilter in the httpd component, and the argument page. It says the attack may be launched remotely.
No fixed firmware version appears in the record. The Tenda site I fetched was only the corporate home page, so I could not verify a patch. Check the vendor download page for your model.
How to check if you're exposed
Log in to the router and read the firmware version. If it shows 1.0.0.3, you are in scope.
Check whether the management interface is reachable from the internet. Remote management exposed to the WAN is the most dangerous setting for this kind of flaw.
Look at the device's download page on the Tenda site for any firmware newer than 1.0.0.3.
What to do now
- Turn off remote management and any port forwarding to the router administration interface.
- Limit the admin interface to a trusted internal network.
- Check the Tenda support page for newer firmware and apply it if it exists.
- Replace the device if the vendor offers no update and it protects something important.
- Change the administration password.
Why it matters
The weaknesses are CWE-119, improper restriction of operations within a memory buffer, and CWE-120, a classic buffer overflow where input is copied without a size check.
On small router firmware, a memory bug in the web server can lead to a crash or to code running on the device. NVD notes the exploit is public, which shortens the time before scanning begins, but the record does not say it is exploited in the wild, and its KEV flag is false.
Quick check
Is the router safe if the admin page is not on the internet?
The record says the attack can be launched remotely. Keeping the admin page off the WAN greatly narrows who can try it, but it does not fix the firmware.
Sources
Last reviewed: 19 October 2026.
