Tenda O3 Router CVE-2026-36778

Exploitation requires high-privilege authentication on the target device (PR:H per CVSS vector) - the attacker must hold valid administrator credentials before triggering the overflow. The vulnerable code path is in R7WebsSecurityHandler, meaning the router's HTTP-based management web server must be reachable by the attacker (AV:N confirms network accessibility). No user interaction is required beyond the attacker's own authenticated session (UI:N). Exploitation is limited by: (1) the requirement for admin-level credentials, (2) applicability only to firmware version v1.0.0.5(4180) - other firmware versions are neither confirmed affected nor unaffected, and (3) impact restricted to availability (DoS/crash), with no evidence of confidentiality or integrity impact from available data.

CVSS rates this at 4.9 Medium with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The network vector and low attack complexity are partially offset by the high privilege requirement (PR:H), meaning an attacker must already hold administrator-level credentials on the device. EPSS of 0.01% at the 2nd percentile signals negligible observed exploitation activity in the wild. This CVE is not listed in the CISA KEV catalog. No POC exploit has been confirmed; the sole reference is a third-party GitHub repository (xhh0124/SemVulLLM) that appears to be an academic/research collection, not a weaponized exploit release. The real-world risk is low-to-moderate: while the attack path is network-accessible and requires no user interaction, the high-privilege prerequisite limits exposure to scenarios involving credential theft, brute-force of default admin passwords (common in consumer routers), or malicious insiders. The impact is limited to device availability, not data confidentiality or integrity, consistent with a DoS-class finding.

An attacker who has obtained or guessed the router's administrator credentials authenticates to the Tenda O3 web management interface over the network, then sends a crafted HTTP POST request containing an abnormally long string in the username parameter to the R7WebsSecurityHandler endpoint. The oversized input overflows the stack buffer in the handler function, causing the router's web server process or the device itself to crash and become unavailable until manually rebooted. No confirmed POC exploit is publicly available, but the research repository linked in the references suggests proof-of-concept testing has been conducted.