Tenda W3 Router CVE-2026-36772

Adjacent network access is required - the attacker must share the same local network segment (LAN, Wi-Fi, or directly adjacent subnet) as the Tenda W3 router; internet-based remote exploitation is not possible per the AV:A vector. No authentication is required (PR:N), and no victim interaction is needed (UI:N). The vulnerable code path is triggered through the wl_radio parameter of the formwrlSSIDget function in the router's web management interface; exploitation depends on that interface being reachable from the attacker's network position. The impact is strictly limited to Denial of Service - no code execution, credential theft, or persistent access is achievable through this vulnerability. Exploitation is further constrained to firmware version v1.0.0.3(2204); whether other versions are vulnerable is unconfirmed.

The CVSS 6.5 Medium score is calibrated appropriately for this vulnerability. The Adjacent attack vector (AV:A) is the most significant limiting factor: an attacker must be on the same Layer 2 or Layer 3 network segment as the router, restricting the exposure to local network threats such as rogue devices, compromised LAN hosts, or Wi-Fi clients. No privileges are required (PR:N) and no user interaction is needed (UI:N), making exploitation trivially simple for any attacker who achieves network adjacency. However, the impact is capped at Availability (A:H) with no confidentiality or integrity effects, meaning the worst case is a device crash or reboot - not data theft or persistent compromise. EPSS at 0.02% (5th percentile) confirms that automated or widespread exploitation is not observed or anticipated. The vulnerability is not listed in CISA KEV. The GitHub reference points to a research repository (SemVulLLM) rather than a working exploit tool, so no confirmed functional exploit code exists. Overall, this is a low operational priority except for environments where Tenda W3 routers are deployed in sensitive network segments where device availability is critical.

An attacker connected to the same local network as the Tenda W3 router - for example, a guest Wi-Fi client or a compromised LAN device - sends an HTTP request to the router's web management interface with an abnormally long value in the wl_radio parameter targeting the formwrlSSIDget endpoint. The oversized input overflows the fixed stack buffer in the function, corrupting the stack and causing the router process to crash, rendering the device temporarily unavailable until it reboots. No authentication or special tooling is required beyond crafting a malformed HTTP request.