What is the CVSS score of CVE-2026-36792?

CVE-2026-36792 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W3 are affected by CVE-2026-36792?

Tenda W3 Wireless Router firmware v1.0.0.3(2204) contains a remote unauthenticated denial-of-service vulnerability (CVE-2026-36792) that allows attackers to crash the device via malicious HTTP…

How to fix or mitigate CVE-2026-36792?

Within 24 hours: Audit all Tenda W3 devices in production, document firmware versions, and map network criticality. Within 7 days: Implement network-level compensating controls (see below) and restrict HTTP access to router management interfaces from trusted networks only. Within 30 days: Monitor Tenda security advisories for patch availability; develop contingency plan for device replacement if patch remains unavailable beyond 90 days.

Tenda W3 CVE-2026-36792

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Stack Overflow Tenda Denial Of Service Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 19:24 vuln.today

CVSS changed

Jun 10, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:00 nvd

HIGH 7.5

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parameter of the formWifiRadioSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request containing a malicious wl_radio parameter to the formWifiRadioSet function. EPSS scoring (0.01%, 2nd percentile) indicates very low real-world exploitation probability, and no public exploit identified at time of analysis beyond a research repository referencing the vulnerable function.

Technical ContextAI

The vulnerability resides in the formWifiRadioSet handler within the web management interface of the Tenda W3 consumer wireless router, a SOHO device commonly deployed at network edges. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), meaning that user-controlled input passed to the wl_radio HTTP parameter is copied onto a fixed-size stack buffer without bounds checking, corrupting the stack frame. Tenda's web management daemon (httpd) is written in C and reuses a code pattern shared across many of its routers, where formXxx() handler functions process POST parameters via unsafe string operations such as strcpy/sprintf, which has historically led to similar stack overflows in the Tenda product line.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory or fixed firmware version in the referenced intelligence, so monitor https://www.tendacn.com for a firmware update superseding v1.0.0.3(2204). As compensating controls, disable WAN-side remote web management (typically labeled 'Remote Web Management' or 'Remote Management' in the admin UI) to prevent internet-based exploitation, restrict LAN-side access to the router's HTTP/HTTPS admin interface via firewall ACLs or VLAN segmentation so only trusted management hosts can reach it, and where the W3 is deployed in a sensitive role, plan replacement with a supported device since end-of-life Tenda consumer routers typically receive no further security updates. The trade-off of disabling remote management is loss of off-LAN administration; restricting admin access by VLAN may complicate legitimate remote support workflows.