What is the CVSS score of CVE-2026-36778?

CVE-2026-36778 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Tenda O3 Router CVE-2026-36778

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Buffer Overflow Denial Of Service Stack Overflow Tenda N A

4.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:56 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

4.9 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the username parameter of the R7WebsSecurityHandler function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Stack-based buffer overflow in Tenda O3 Wireless Router firmware v1.0.0.5(4180) enables authenticated remote attackers to crash the device by submitting an oversized username value to the R7WebsSecurityHandler HTTP handler. The CVSS vector (PR:H) confirms that exploitation requires high-privilege authentication, constraining the attack surface to compromised admin credentials or insider threat scenarios. No public exploit identified at time of analysis and EPSS sits at the 2nd percentile (0.01%), reflecting low observed exploitation interest.

Technical ContextAI

CWE-121 (Stack-based Buffer Overflow) describes a class of memory corruption bugs where a fixed-size stack buffer is written beyond its bounds, corrupting adjacent stack frames or return addresses. In this case, the R7WebsSecurityHandler function - part of the router's embedded HTTP server handling authentication requests - fails to enforce a length check on the inbound username parameter before copying it to a stack-allocated buffer. Tenda O3 is a consumer-grade wireless router running a Linux-based embedded firmware. The CPE entry in the NVD record is unpopulated (cpe:2.3:a:n/a:n/a), meaning automated asset matching against this CPE will not function; the affected product is solely identified via the CVE description as firmware version v1.0.0.5(4180). The overflow impacts availability only (A:H, C:N, I:N per CVSS), consistent with a crash/reboot DoS rather than code execution, though stack overflows of this class can theoretically be chained to RCE under certain conditions not evidenced in available data.

RemediationAI

No vendor-released patch identified at time of analysis. No official Tenda security advisory is available in the provided references. As a primary compensating control, administrators should restrict access to the router's web management interface to trusted LAN addresses only and disable remote (WAN-side) management if enabled - this prevents network-based exploitation without requiring firmware changes, though it does not eliminate risk from LAN-side authenticated users. Additionally, ensure the admin password is changed from the factory default to a strong, unique credential, as PR:H exploitation depends on possessing valid admin credentials. Monitoring for unexpected reboots may help detect exploitation attempts. Users should check the official Tenda support portal for firmware updates addressing this issue, as patch availability could not be confirmed from available data.