What is the CVSS score of CVE-2026-2180?

CVE-2026-2180 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Rx3 Firmware are affected by CVE-2026-2180?

A high-severity vulnerability (CVSS 8.8) affects Tenda RX3 wireless routers with no available patch and active public exploits in circulation.

Is there a public PoC exploit available for CVE-2026-2180?

Yes, a public proof-of-concept exploit is available for CVE-2026-2180. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-2180?

Within 24 hours: Inventory all Tenda RX3 16.03.13.11 devices in production and isolate or disable affected units if operationally feasible. Within 7 days: Implement network segmentation to restrict administrative access to affected routers and monitor for suspicious activity on vulnerable devices. Within 30 days: Plan migration to alternative router hardware from vendors with active security patching; escalate vendor contact for patch timeline or evaluate managed security appliance replacement.

Rx3 Firmware CVE-2026-2180

HIGH

Buffer Overflow (CWE-119)

2026-02-08 cna@vuldb.com

Buffer Overflow Stack Overflow Rx3 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 10, 2026 - 14:43 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 20:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows unauthenticated remote attackers to achieve code execution by sending a malicious SSID value to the /goform/fast_setting_wifi_set endpoint. Public exploit code exists for this vulnerability and no patch is currently available. An attacker can exploit this to gain complete system compromise with high integrity and availability impact.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Rx3 Firmware. A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.