What is the CVSS score of CVE-2026-36783?

CVE-2026-36783 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda O3 Router are affected by CVE-2026-36783?

Tenda O3 wireless routers running firmware v1.0.0.5(4180) are vulnerable to unauthenticated remote denial-of-service attacks that crash the web management service, disrupting network administrative…

How to fix or mitigate CVE-2026-36783?

Within 24 hours: Inventory all Tenda O3 routers in production and verify firmware version v1.0.0.5(4180); restrict HTTP/HTTPS access to management interfaces via firewall rules and network segmentation. Within 7 days: Implement VLAN isolation for router management traffic and limit administrative access to known internal networks only; disable remote management if not operationally required. Within 30 days: Contact Tenda support for patch timeline and roadmap; establish upgrade schedule for confirmed patched firmware versions or evaluate router replacement if patch is not forthcoming.

Tenda O3 Router CVE-2026-36783

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Tenda Denial Of Service Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated HTTP request to network-reachable admin interface (AV:N/AC:L/PR:N/UI:N); described impact is process crash only, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 22:31 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the domain parameter of the fromNetToolGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial-of-service via stack buffer overflow affects the Tenda O3 wireless router firmware v1.0.0.5(4180), where the fromNetToolGet handler fails to bound-check the domain parameter supplied in HTTP requests. Remote attackers can crash the router's web management service by sending a crafted request, disrupting network connectivity for downstream clients. SSVC flags the issue as proof-of-concept with automatable exploitation and partial technical impact, though EPSS remains low at 0.01% and no in-the-wild exploitation has been confirmed.

Technical ContextAI

The Tenda O3 is a SOHO/outdoor wireless CPE router whose embedded web administration server exposes a network diagnostic endpoint backed by the fromNetToolGet function. CWE-121 (Stack-based Buffer Overflow) describes the root cause: the function copies the user-controlled 'domain' HTTP parameter into a fixed-size stack buffer without length validation, allowing the saved return address and adjacent stack frame to be overwritten. On the MIPS/ARM-class SoCs typical of Tenda CPE devices, this corruption typically crashes the httpd/goahead-style web server process; while CWE-121 can sometimes be escalated to code execution, the public research (referenced GitHub PoC by xhh0124/SemVulLLM) only demonstrates a denial-of-service crash. The CPE entry of 'cpe:2.3:a:n/a:n/a:*' is a placeholder and does not properly enumerate the affected hardware/firmware tuple.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published a fixed firmware version in the available references. As compensating controls, restrict access to the router's HTTP management interface so it is reachable only from trusted LAN segments - disable WAN-side remote management entirely via the device admin UI, which is the highest-impact mitigation and has minimal trade-off for residential/SOHO use. Where remote administration is required, place the management interface behind a VPN or source-IP ACL on an upstream firewall to block untrusted HTTP requests targeting the fromNetToolGet endpoint; this preserves admin capability at the cost of added connection setup. Monitor the device for unexpected reboots or web-UI unavailability as a detection signal, and consult https://github.com/xhh0124/SemVulLLM/tree/main/O3/fromNetToolGet for the PoC payload shape to build IDS/WAF signatures matching oversized 'domain' parameters to /goform/ or equivalent network-tool endpoints.