Tenda W3 CVE-2026-36773

Attacker must have adjacent network access - meaning physical presence on the same Layer 2 broadcast domain (local wired or wireless network segment) as the Tenda W3 router. The CVSS vector PR:N confirms exploitation requires no authentication credentials. AC:L confirms no special race conditions or environmental setup beyond network adjacency. The ask_to_reboot function handling the Go parameter must be reachable, which is expected in the default configuration of this consumer router's management interface. Exploitation is limited to DoS only - no code execution or data exfiltration is indicated. External internet-based attackers are excluded unless remote management has been explicitly enabled and exposed, which is non-default. Devices running firmware versions other than v1.0.0.3(2204) have not been assessed.

The real-world risk is moderate-to-low for most environments. CVSS 6.5 with AV:A constrains exploitation to attackers already present on the same Layer 2 or Layer 3 network segment as the router - external internet-based attackers cannot directly reach this service. PR:N and AC:L indicate that once adjacent network access is achieved, exploitation requires no credentials and minimal technical complexity, which is a meaningful risk factor in environments with untrusted devices or guest networks sharing the same segment. Impact is limited to availability (A:H), with no confidentiality or integrity exposure confirmed. EPSS at 0.02% (5th percentile) is extremely low, suggesting this vulnerability has seen little or no observed exploitation in the wild. No KEV listing and no confirmed public PoC are present, though the GitHub reference repository (SemVulLLM) appears to be a security research collection that may contain proof-of-concept artifacts - this is inferred, not confirmed. The primary realistic risk is targeted disruption of the router in small business or home network contexts where physical or network proximity is possible.

An attacker connected to the same local network as the Tenda W3 router - such as a guest on a shared Wi-Fi network or a compromised device on the LAN - sends a crafted HTTP request to the router's management interface targeting the ask_to_reboot function with an oversized Go parameter value. The lack of bounds checking causes the parameter to overflow the stack buffer, corrupting the stack frame and crashing the router's web server process or the device itself, rendering it unresponsive and cutting off network connectivity for all connected clients. The GitHub research reference suggests exploit code or reproduction steps may be publicly accessible in that repository, though active exploitation has not been confirmed.