What is the CVSS score of CVE-2026-36793?

CVE-2026-36793 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W3 are affected by CVE-2026-36793?

Tenda W3 Wireless Router firmware v1.0.0.3(2204) contains a denial-of-service vulnerability allowing remote, unauthenticated attackers to crash affected devices without user interaction.

How to fix or mitigate CVE-2026-36793?

24 hours: Identify all Tenda W3 routers running firmware v1.0.0.3(2204) or earlier; assess business criticality and document current inventory. 7 days: Implement firewall restrictions preventing direct internet access to affected devices, segment administrative interfaces from untrusted networks, and enable router access logging. 30 days: Monitor Tenda Security Advisories for firmware patch release; establish device upgrade or replacement plan if no patch is announced.

Tenda W3 CVE-2026-36793

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Buffer Overflow Denial Of Service Stack Overflow Tenda N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:26 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the formwrlSSIDset function via the mit_ssid and mis_ssid_index parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending crafted HTTP requests that trigger stack-based buffer overflows in the formwrlSSIDset handler. The flaw is reachable without authentication or user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but EPSS is only 0.01% and no public exploit identified at time of analysis suggests low near-term mass-exploitation likelihood despite the trivial attack surface.

Technical ContextAI

The vulnerable component is the embedded HTTP management daemon of the Tenda W3 SOHO wireless router, specifically the formwrlSSIDset function which processes wireless SSID configuration submissions. Two parameters - mit_ssid and mis_ssid_index - are copied into fixed-size stack buffers without proper length validation, matching CWE-121 (Stack-based Buffer Overflow). Tenda's web management firmware historically uses C-based form handlers (httpd/goahead derivatives) where parameter values from POST bodies are passed to unsafe routines like strcpy or sprintf, corrupting saved frame pointers and return addresses on the call stack. The referenced research at github.com/xhh0124/SemVulLLM points to reverse-engineered analysis of function FUN_00442b44, indicating the issue was identified through static binary analysis of the MIPS/ARM router firmware rather than vendor disclosure.

RemediationAI

No vendor-released patch identified at time of analysis - the only public reference is third-party vulnerability research, not a Tenda security bulletin. Owners of the Tenda W3 v1.0.0.3(2204) should check tendacn.com for firmware updates referencing formwrlSSIDset or SSID handling fixes and apply the newest available image. Until a fix is published, disable remote/WAN-side web management entirely (this is the highest-value mitigation and has no functional cost for typical home users), restrict LAN-side access to the management interface to a specific admin VLAN or trusted MAC, and consider replacing the device if it is end-of-life and unlikely to receive firmware updates - a consideration likely for an older W3 SKU. If the router must remain in service, accept that a malicious LAN client can trivially reboot/crash it and plan for resilience (UPS, monitored uptime) rather than relying on the device's HTTP service.