What is the CVSS score of CVE-2026-36791?

CVE-2026-36791 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda O3v3 are affected by CVE-2026-36791?

Tenda O3v3 router firmware v1.0.0.5 contains a remotely exploitable denial-of-service vulnerability that allows unauthenticated attackers to crash the device, potentially disrupting network…

How to fix or mitigate CVE-2026-36791?

Within 24 hours: Identify all Tenda O3v3 devices on the network and their software versions; perform initial risk assessment based on device placement and criticality. Within 7 days: Implement network access controls (e.g., firewall rules) to restrict HTTP requests to the device admin interface from untrusted networks; disable remote management features if not required. Within 30 days: Request patch timeline from Tenda; given no patch is currently available, evaluate replacement with alternative firmware or devices; perform full inventory of affected models across the organization.

Tenda O3v3 CVE-2026-36791

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Buffer Overflow Stack Overflow Tenda N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:24 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda O3v3 v1.0.0.5 was discovered to contain a stack overflow in the save_list_data parameter of the formSetCfm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda O3v3 firmware v1.0.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the formSetCfm handler. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the network-reachable, no-authentication attack surface on a CPE/router device makes this relevant for exposed deployments.

Technical ContextAI

The Tenda O3v3 is an outdoor CPE/wireless bridge product. The vulnerable component is the web management interface's formSetCfm handler, which processes the save_list_data parameter without sufficient bounds checking before copying it onto the stack. This is a classic CWE-121 stack-based buffer overflow in embedded MIPS/ARM router firmware - the same vulnerability class that has affected numerous Tenda HTTP handlers historically, typically caused by use of unsafe string functions (strcpy/sprintf) on attacker-controlled HTTP form fields. CPE data is not meaningfully populated by NVD (placeholder n/a:n/a), so the affected target must be derived from the description rather than structured CPE matching.

RemediationAI

No vendor-released patch identified at time of analysis. Operators of Tenda O3v3 v1.0.0.5 should check Tenda's support portal for a firmware update addressing formSetCfm and apply it once available, and in the interim restrict access to the device's HTTP management interface to a trusted management VLAN or specific administrator IPs via ACL - this eliminates remote exploitability but means administrators must use a jump host or on-site access for configuration. Disabling remote/WAN-side web administration if enabled is a high-value compensating control with minimal operational impact for most deployments. As a last resort where exposure cannot be reduced, monitor for unexpected device reboots and place the device behind an upstream firewall that can rate-limit or filter unusual POST requests to the form handlers; this will not prevent a determined attacker on the same network segment. Research reference for triage: https://github.com/xhh0124/SemVulLLM/tree/main/O3/formSetCfm.