What is the CVSS score of CVE-2026-36777?

CVE-2026-36777 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Tenda W3 CVE-2026-36777

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Buffer Overflow Stack Overflow Tenda N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:55 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the param_1 parameter of the formSetCfm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Stack-based buffer overflow in the Tenda W3 Wireless Router v1.0.0.3(2204) enables adjacent-network unauthenticated attackers to crash the device via the formSetCfm HTTP endpoint. The vulnerability resides in the param_1 parameter of the formSetCfm function, where insufficient input validation allows a crafted HTTP request to overflow a stack buffer, resulting in a Denial of Service. A public GitHub repository linked in the references (xhh0124/SemVulLLM) appears to document or demonstrate the issue; no public exploit identified at time of analysis beyond that reference, and the EPSS score of 0.01% (2nd percentile) reflects very low exploitation probability.

Technical ContextAI

CWE-121 (Stack-based Buffer Overflow) indicates that the formSetCfm function in the router's embedded web server copies attacker-controlled input from the param_1 HTTP parameter into a fixed-size stack buffer without adequate bounds checking. Stack overflows on embedded router firmware typically overwrite the saved return address or adjacent stack data, leading to an abnormal control-flow termination - in this case manifesting as a DoS rather than code execution, consistent with the CVSS impact of A:H/C:N/I:N. The affected CPE is listed as n/a in the NVD record, meaning no structured CPE string has been formally assigned; the product is confirmed as Tenda W3 firmware version v1.0.0.3(2204) per the CVE description. The CVSS attack vector of AV:A (Adjacent) indicates exploitation requires Layer-2 or subnet-level proximity, consistent with embedded home/SOHO router administration interfaces that are typically bound to the LAN-side interface.

RemediationAI

No vendor-released patch has been identified at time of analysis - no Tenda security advisory or updated firmware version is referenced in the available data. As a compensating control, administrators should ensure the router's web administration interface is accessible only from trusted LAN-side hosts by restricting management access via the router's built-in ACL or firewall rules if supported; this does not eliminate the vulnerability but reduces the attacker pool. Additionally, placing the Tenda W3 on a dedicated, access-controlled network segment (e.g., isolated VLAN with limited client access) reduces exposure, though this may complicate normal LAN routing. Users should monitor Tenda's official support site for firmware updates and apply any released patch promptly. If the device is end-of-life and unsupported, replacement with a maintained alternative is the most effective long-term mitigation.