What is the CVSS score of CVE-2026-36771?

CVE-2026-36771 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W3 Router are affected by CVE-2026-36771?

The Tenda W3 Wireless Router (firmware v1.0.0.3(2204)) is vulnerable to remote denial-of-service attacks that can crash the device, disabling wireless network connectivity for all connected users.

How to fix or mitigate CVE-2026-36771?

Within 24 hours: Audit inventory for all Tenda W3 routers running firmware v1.0.0.3(2204) and document network locations; disable remote management and UPnP features. Within 7 days: Implement firewall rules restricting network access to affected devices; deploy monitoring for suspicious traffic patterns targeting the wl_radio parameter. Within 30 days: Escalate to Tenda for patch availability and timeline; develop hardware replacement or firmware upgrade plan as vendor updates become available.

Tenda W3 Router CVE-2026-36771

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:21 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parameter of the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Denial-of-service in the Tenda W3 Wireless Router (firmware v1.0.0.3(2204)) allows remote unauthenticated attackers to crash the device by sending crafted input to the wl_radio parameter of the formwrlSSIDset function, triggering a stack-based buffer overflow. Publicly available exploit research exists in a GitHub repository, but no public exploit identified for weaponized use at time of analysis and the issue is not listed in CISA KEV. The CVSS 7.5 score reflects high availability impact without confidentiality or integrity loss.

Technical ContextAI

The flaw resides in the formwrlSSIDset HTTP form handler exposed by the router's embedded web management interface, which processes wireless SSID configuration parameters including wl_radio. The root cause is CWE-121 (Stack-based Buffer Overflow): the handler copies attacker-controlled wl_radio input into a fixed-size stack buffer without proper bounds checking, corrupting the saved return address or adjacent stack frame data and crashing the HTTP daemon. Tenda SOHO routers commonly run a BusyBox/Linux firmware with custom CGI binaries (httpd/goahead-style) where similar overflow patterns have been disclosed across the Tenda product line. The supplied CPE string is a placeholder ('n/a'), so the authoritative affected product identifier comes from the description text rather than NVD CPE data.

RemediationAI

No vendor-released patch identified at time of analysis. Until Tenda publishes updated firmware for the W3, restrict access to the router's web management interface by ensuring remote/WAN management is disabled (this is typically the default but should be verified), and segment the management VLAN so only trusted administrative hosts can reach the HTTP admin port - the trade-off is reduced convenience for remote administration. Consider replacing the device with a supported model if it is end-of-life, and monitor https://github.com/xhh0124/SemVulLLM/tree/main/W3/formwrlSSIDset and the Tenda support site for a fixed firmware release. As a stronger compensating control, place the router behind a properly secured upstream firewall and disable Wi-Fi SSID self-service portals or any feature that allows untrusted clients to reach formwrlSSIDset.