What is the CVSS score of CVE-2026-36794?

CVE-2026-36794 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W3 Router are affected by CVE-2026-36794?

Tenda W3 Wireless Router firmware v1.0.0.3(2204) contains a denial-of-service vulnerability allowing unauthenticated remote attackers to crash the device through malformed HTTP requests, disrupting…

How to fix or mitigate CVE-2026-36794?

24 hours: Inventory all Tenda W3 routers and confirm deployment of firmware v1.0.0.3(2204) in production environments. 7 days: Restrict remote web management interface access to authorized administrator IP addresses only using firewall rules; enable detailed access and system logging. 30 days: Contact Tenda support to confirm patch timeline and release date; develop remediation plan including firmware upgrade or device replacement if patches remain unavailable after 90 days.

Tenda W3 Router CVE-2026-36794

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Buffer Overflow Denial Of Service Stack Overflow Tenda N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:27 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the R7WebsSecurityHandler function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows unauthenticated remote attackers to crash the device by sending crafted HTTP requests with oversized username or password parameters that overflow stack buffers in the R7WebsSecurityHandler function. The flaw affects the router's web management interface and carries a CVSS 7.5 (availability-only impact); no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.01%.

Technical ContextAI

The vulnerability resides in R7WebsSecurityHandler, a request-handling routine in the embedded GoAhead-derived web server used by Tenda's consumer SOHO routers. The function processes login parameters (username and password) from incoming HTTP requests and copies them into fixed-size stack buffers without proper length validation, matching CWE-121 (Stack-based Buffer Overflow). Because the overflow corrupts stack memory in the httpd process, the most consistent observed outcome is a process crash and device-wide service disruption; on MIPS-based embedded targets like the W3, mitigations such as stack canaries and ASLR are commonly weak or absent, but the CVSS impact metrics (C:N/I:N/A:H) indicate availability impact only - code execution has not been claimed by the reporter. CPE data in the feed is a placeholder (cpe:2.3:a:n/a:n/a) and does not contain a usable product identifier, so affected scope must be taken from the description text.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor Tenda's support site (tendacn.com) for a firmware update addressing R7WebsSecurityHandler and apply it to W3 devices on v1.0.0.3(2204) as soon as it is published. Until a fix is available, the most effective compensating control is to disable WAN-side remote management on the web UI so the vulnerable handler is not reachable from the internet, and to restrict LAN-side access to the admin interface to a management VLAN or a small set of trusted hosts - the trade-off is that legitimate remote administration and casual LAN-based configuration become more cumbersome. Network operators can additionally rate-limit or drop oversized POSTs to the login endpoint at an upstream firewall, accepting the risk that some legitimate but long credentials may be blocked. For environments that cannot accept ongoing DoS risk, replacing the device is the only durable mitigation given the residual unauthenticated exposure and the absence of a vendor fix; reference the researcher PoC at https://github.com/xhh0124/SemVulLLM/tree/main/W3/R7WebsSecurityHandler for indicators useful in detection tuning.