Tenda PW201A CVE-2026-36802

The attacker needs network reachability to the PW201A's HTTP administrative interface (typically LAN-side on port 80 by default; WAN-side only if remote management has been explicitly enabled, which is non-default). No authentication, no user interaction, and no special privileges are required (PR:N/UI:N). The target must be running firmware v1.0.5 of the Tenda PW201A, and the SafeMacFilter handler must be reachable - it is part of the standard web admin and present in default configurations. The limiting factor is reachability of the admin HTTP interface, not feature toggles or configuration state.

The CVSS 7.5 score reflects a network-reachable, low-complexity, unauthenticated attack (AV:N/AC:L/PR:N/UI:N) with high availability impact and no confidentiality/integrity impact - typical for a remote DoS. However, EPSS is extremely low at 0.02% (4th percentile), and there is no KEV listing and no public exploit identified at time of analysis, indicating no observed exploitation pressure. The realistic risk is moderate but tightly scoped: Tenda routers' admin web interfaces are usually only reachable from the LAN, so 'AV:N' overstates real-world reachability unless the management interface is WAN-exposed. The CPE is a placeholder, and references point only to a research repo - vendor confirmation of affected build IDs is missing.

An attacker on the same LAN as a vulnerable PW201A - for example a guest on the wireless network or a compromised IoT device - sends a single crafted HTTP POST to the SafeMacFilter endpoint with an oversized page parameter. The httpd process crashes, taking down the router's web UI and likely network connectivity until the device reboots. If the admin interface is mistakenly exposed to the WAN, the same request can be sent remotely with no authentication.