What is the CVSS score of CVE-2026-36770?

CVE-2026-36770 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda US_W3V1.0BR are affected by CVE-2026-36770?

Tenda US_W3V1.0BR routers running firmware v1.0.0.3 contain a remote denial of service vulnerability allowing unauthenticated network attackers to crash devices, directly impacting network…

How to fix or mitigate CVE-2026-36770?

Within 24 hours: Identify all Tenda US_W3V1.0BR v1.0.0.3 devices in your infrastructure; implement firewall rules restricting access to device management interfaces from untrusted networks; enable network logging for traffic targeting these devices. Within 7 days: Check Tenda's official security advisory page for available firmware updates; if patches exist, plan testing and deployment schedule; isolate affected routers to dedicated VLANs with strict access controls. Within 30 days: Deploy firmware updates when released by vendor; if no patch is available, develop replacement plan for alternative router models; conduct access control audit and document all implemented mitigations.

Tenda US_W3V1.0BR CVE-2026-36770

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:21 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack overflow in the Go parameter of the ask_to_reboot function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Remote denial of service in Tenda US_W3V1.0BR router firmware v1.0.0.3 allows unauthenticated network attackers to crash the device by sending a crafted value in the 'Go' parameter to the ask_to_reboot function, triggering a stack-based buffer overflow. No public exploit identified at time of analysis, though a third-party research repository on GitHub references the vulnerable function.

Technical ContextAI

The flaw resides in the ask_to_reboot handler of the Tenda US_W3V1.0BR consumer router's web management interface, where the 'Go' HTTP parameter is copied into a fixed-size stack buffer without adequate bounds checking. This is a classic CWE-121 (Stack-based Buffer Overflow) condition in embedded MIPS/ARM SOHO router firmware, a code pattern repeatedly identified across Tenda's product line where httpd-style CGI handlers parse query parameters using unsafe string operations (e.g., strcpy/sprintf) into stack frames. While the CVSS vector reports availability-only impact (C:N/I:N/A:H), the underlying primitive is a memory-corruption flaw that could in principle be escalated; the provided intelligence only substantiates the DoS outcome. CPE data was generic (cpe:2.3:a:n/a:n/a) and does not authoritatively bind the CVE to a specific vendor/product record.

RemediationAI

No vendor-released patch identified at time of analysis; the only referenced URL is a third-party GitHub research repository (https://github.com/xhh0124/SemVulLLM/tree/main/W3/ask_to_reboot), not a Tenda security bulletin. Until Tenda publishes fixed firmware, restrict reachability of the router's web management interface by disabling any WAN-side remote management option and limiting LAN-side access to a trusted management VLAN or specific admin IPs via firewall rules - the trade-off is loss of convenient remote administration and added segmentation overhead. Consider replacing internet-exposed units with a supported model if Tenda does not issue a firmware update, and monitor Tenda's official security page for an advisory specifically referencing CVE-2026-36770 and the ask_to_reboot function.