What is the CVSS score of CVE-2026-36784?

CVE-2026-36784 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda O3 Router are affected by CVE-2026-36784?

The Tenda O3 Wireless Router (firmware v1.0.0.5(4180)) is vulnerable to a remote denial-of-service attack allowing unauthenticated attackers to crash affected devices, potentially disrupting network…

How to fix or mitigate CVE-2026-36784?

Within 24 hours: Identify and inventory all Tenda O3 routers running firmware v1.0.0.5(4180); restrict HTTP access to these devices via firewall rules allowing management traffic from designated admin IPs only. Within 7 days: Segment affected routers onto isolated network subnets; enable logging and configure alerts for suspicious HTTP requests targeting the fromNetToolGet function. Within 30 days: Contact Tenda for patched firmware availability; if no patch is released within 30 days, prepare device replacement plan or decommissioning schedule to eliminate persistent DoS exposure.

Tenda O3 Router CVE-2026-36784

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Stack Overflow Tenda Denial Of Service Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 19:23 vuln.today

CVSS changed

Jun 10, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the ip parameter of the fromNetToolGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a HTTP request.

AnalysisAI

Denial of service in the Tenda O3 Wireless Router (firmware v1.0.0.5(4180)) allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the ip parameter of the fromNetToolGet function. Publicly available exploit code exists in a GitHub research repository, though EPSS rates exploitation probability at only 0.02% and the issue is not on CISA KEV. Impact is limited to availability (the CVSS A:H, C:N, I:N profile), making this primarily a device-crash bug rather than a code-execution vector based on the reported analysis.

Technical ContextAI

The Tenda O3 is an outdoor CPE/wireless router, and like much of Tenda's SOHO product line it exposes a lighttpd/goahead-style web management interface implemented in native C binaries on the embedded MIPS/ARM firmware. The fromNetToolGet handler implements the router's built-in network diagnostic tools (ping/traceroute) and copies the user-supplied ip query parameter into a fixed-size stack buffer without sufficient length validation, matching CWE-121 (Stack-based Buffer Overflow). Because the parameter is parsed before authentication on many Tenda web stacks and is reachable over the HTTP management interface, an oversize value corrupts the saved return address and crashes the webs/httpd process. The provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and does not actually identify the device, so the affected product must be derived from the description rather than NVD's CPE data.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory in the provided references, and only the researcher PoC at https://github.com/xhh0124/SemVulLLM/tree/main/O3/fromNetToolGet_ip is available. Operators of Tenda O3 v1.0.0.5(4180) units should check tendacn.com for a firmware update past 1.0.0.5(4180) and apply it once issued. Until a fix ships, restrict reachability of the web management interface by disabling WAN-side remote management (this loses remote admin convenience), placing the device's LAN-side admin VLAN behind an ACL that only allows known operator IPs (adds change-control overhead), and blocking inbound TCP/80 and TCP/443 to the device from untrusted networks. If the diagnostic page is not needed, blocking access to the /goform/fromNetToolGet endpoint at an upstream proxy or filtering rule will neutralize this specific vector without disabling other management functions, at the cost of losing the built-in ping/traceroute tool. Monitor for repeated webs/httpd process restarts as an indicator of attempted exploitation.