What is the CVSS score of CVE-2026-36772?

CVE-2026-36772 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Tenda W3 Router CVE-2026-36772

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Buffer Overflow Stack Overflow Tenda N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:52 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parameter of the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Stack-based buffer overflow in the Tenda W3 Wireless Router v1.0.0.3(2204) enables adjacent-network unauthenticated attackers to crash the device by supplying an oversized wl_radio parameter to the formwrlSSIDget function. Impact is limited strictly to Denial of Service (availability loss); no confidentiality or integrity impact is possible per CVSS vector analysis. No public exploit identified at time of analysis, and EPSS exploitation probability is extremely low at 0.02% (5th percentile), placing this firmly in the lower-priority tier despite the High availability impact rating.

Technical ContextAI

The affected function formwrlSSIDget handles wireless SSID retrieval operations in the Tenda W3 router firmware. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: the function copies attacker-supplied data from the wl_radio parameter into a fixed-size stack buffer without performing adequate bounds checking, causing stack corruption when input exceeds the allocated buffer size. This is a classic embedded firmware vulnerability pattern common to consumer-grade routers where firmware development often foregoes secure coding practices such as length validation or safe string functions. The CPE entry provided (cpe:2.3:a:n/a:n/a) is a placeholder and does not yield additional product scope data; affected product identity is derived entirely from the CVE description. The CVSS attack vector is Adjacent (AV:A), meaning exploitation requires the attacker to share a local network segment with the target device - the vulnerability is not directly reachable from the public internet.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published an official security advisory for CVE-2026-36772, and the sole reference is a third-party research repository rather than a vendor-issued fix. As a primary compensating control, restrict access to the router's web management interface to trusted administrative hosts only, using the router's own access control settings if available, or by placing a firewall rule upstream that limits HTTP/HTTPS access to the management port. Additionally, isolate the router's LAN segment so that untrusted devices (guest Wi-Fi clients, IoT devices) cannot reach the management interface, which limits the adjacent-network attacker pool. If the formwrlSSIDget function is invoked through a specific management page, disabling remote web management (if distinct from local management) is a low-impact mitigation. Organizations should monitor Tenda's security advisory page for a firmware update and apply it promptly when released.