What is the CVSS score of CVE-2026-36773?

CVE-2026-36773 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Tenda W3 CVE-2026-36773

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Buffer Overflow Stack Overflow Tenda N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:54 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the Go parameter of the ask_to_reboot function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Stack-based buffer overflow in the Tenda W3 Wireless Router v1.0.0.3(2204) allows adjacent-network unauthenticated attackers to crash the device via a crafted Go parameter submitted to the ask_to_reboot function, resulting in a complete Denial of Service condition. The vulnerability carries a CVSS 6.5 score with High availability impact but no confidentiality or integrity loss, and the attack vector is constrained to adjacent network access. No public exploit confirmation or CISA KEV listing is present, and EPSS at 0.02% (5th percentile) indicates low observed exploitation probability at time of analysis.

Technical ContextAI

CWE-121 identifies this as a Stack-based Buffer Overflow, a classic memory corruption class where user-controlled input is written into a fixed-size stack buffer without adequate bounds checking. The vulnerable function, ask_to_reboot, processes a parameter named Go - likely passed via the router's HTTP-based management interface or a CGI handler - and copies it onto the stack without validating its length. The Tenda W3 is a consumer-grade wireless router running firmware version 1.0.0.3(2204), a MIPS or ARM embedded platform typical of Tenda devices. The CPE data provided (cpe:2.3:a:n/a:n/a) is a placeholder and offers no additional product scoping beyond what the description states. The adjacent network attack vector (AV:A) indicates the exploitable service is accessible on the local network segment, consistent with a router web management interface not exposed to the internet by default.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published an official security advisory for CVE-2026-36773, and no fixed firmware version is referenced in available data. As a primary compensating control, restrict access to the router's management interface to trusted, physically controlled network segments - isolate the management VLAN from guest or untrusted devices to eliminate adjacent-network reach. Disable remote management features if enabled, ensuring the web interface is not accessible from wireless client networks. Consider replacing end-of-life Tenda W3 firmware with a community firmware such as OpenWrt if a supported build exists for this hardware, though compatibility must be independently verified. Monitor the Tenda security advisory page and the referenced GitHub repository for any patch or updated firmware release. Note that network segmentation is the most actionable immediate control but does not eliminate the vulnerability for users who cannot isolate their router management plane.