Tenda W3
CVE-2026-36777
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN/Wi-Fi adjacency to target router
-
DeliveryCraft HTTP request with oversized param_1 value
-
ExploitSubmit request to formSetCfm endpoint
-
ExecutionStack buffer overflow corrupts saved return address
-
PersistRouter process crashes
-
ImpactDevice becomes unresponsive (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have adjacent network access - they must be on the same LAN subnet or Wi-Fi segment as the Tenda W3 router (CVSS AV:A). No authentication is required to reach the vulnerable formSetCfm endpoint (CVSS PR:N), and no user interaction is needed (CVSS UI:N). The router must be running firmware version v1.0.0.3(2204); other versions are not confirmed affected. The limiting factors are: (1) adjacency requirement means internet-based remote attackers cannot directly exploit this without pre-existing LAN foothold; (2) impact is availability-only, with no confirmed path to code execution; (3) SOHO router reboots often auto-recover, so the DoS effect may be transient rather than persistent. |
| Impact | The CVSS base score of 6.5 (Medium) reflects the adjacent-network attack vector (AV:A), which substantially reduces real-world exploitability compared to internet-facing vulnerabilities - an attacker must already reside on the same local network segment as the router. Attack complexity is low (AC:L) and no privileges or user interaction are required (PR:N/UI:N), meaning any LAN-connected device can trigger the crash without credentials. The impact is confined to availability (A:H), with no confidentiality or integrity exposure (C:N/I:N/S:U), limiting the blast radius to device disruption. The EPSS score of 0.01% at the 2nd percentile strongly corroborates low exploitation interest in the wild. No CISA KEV listing exists, and no confirmed weaponized exploit was identified; however, the GitHub reference suggests at minimum a documented proof-of-concept or research artifact. Overall, this vulnerability represents a moderate operational risk for networks where the Tenda W3 is deployed, primarily as a reliability/uptime concern rather than a data-breach vector. The absence of a vendor patch and the prevalence of unmanaged consumer routers in SOHO environments elevates practical risk despite the low EPSS. |
| Exploit ScenarioDerived | An attacker connected to the same LAN or Wi-Fi segment as the Tenda W3 router constructs a crafted HTTP request with an oversized or malformed param_1 value and submits it to the formSetCfm endpoint on the router's embedded web server. The oversized input overflows the stack buffer within the formSetCfm function, corrupting stack state and causing the router's web service or firmware process to crash, rendering the router unresponsive or forcing a reboot. The GitHub repository linked in the references suggests at minimum a documented reproduction case exists for this scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Stack-based buffer overflow in the Tenda W3 Wireless Router v1.0.0.3(2204) enables adjacent-network unauthenticated attackers to crash the device via the formSetCfm HTTP endpoint. The vulnerability resides in the param_1 parameter of the formSetCfm function, where insufficient input validation allows a crafted HTTP request to overflow a stack buffer, resulting in a Denial of Service. A public GitHub repository linked in the references (xhh0124/SemVulLLM) appears to document or demonstrate the issue; no public exploit identified at time of analysis beyond that reference, and the EPSS score of 0.01% (2nd percentile) reflects very low exploitation probability.
RemediationAI
No vendor-released patch has been identified at time of analysis - no Tenda security advisory or updated firmware version is referenced in the available data. As a compensating control, administrators should ensure the router's web administration interface is accessible only from trusted LAN-side hosts by restricting management access via the router's built-in ACL or firewall rules if supported; this does not eliminate the vulnerability but reduces the attacker pool. Additionally, placing the Tenda W3 on a dedicated, access-controlled network segment (e.g., isolated VLAN with limited client access) reduces exposure, though this may complicate normal LAN routing. Users should monitor Tenda's official support site for firmware updates and apply any released patch promptly. If the device is end-of-life and unsupported, replacement with a maintained alternative is the most effective long-term mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 (Stack-based Buffer Overflow) indicates that the formSetCfm function in the router's embedded web server copies attacker-controlled input from the param_1 HTTP parameter into a fixed-size stack buffer without adequate bounds checking. Stack overflows on embedded router firmware typically overwrite the saved return address or adjacent stack data, leading to an abnormal control-flow termination - in this case manifesting as a DoS rather than code execution, consistent with the CVSS impact of A:H/C:N/I:N. The affected CPE is listed as n/a in the NVD record, meaning no structured CPE string has been formally assigned; the product is confirmed as Tenda W3 firmware version v1.0.0.3(2204) per the CVE description. The CVSS attack vector of AV:A (Adjacent) indicates exploitation requires Layer-2 or subnet-level proximity, consistent with embedded home/SOHO router administration interfaces that are typically bound to the LAN-side interface.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the param_1 parameter of the formSetCfm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB