What is the CVSS score of CVE-2026-36802?

CVE-2026-36802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda PW201A are affected by CVE-2026-36802?

Tenda PW201A v1.0.5 routers contain an unauthenticated denial-of-service vulnerability that could cause network outages if exploited; however, no public exploit has been identified and current attack…

How to fix or mitigate CVE-2026-36802?

Within 24 hours: Conduct complete inventory of Tenda PW201A v1.0.5 routers in production. Within 7 days: Implement network segmentation to restrict HTTP access to affected devices; enable monitoring and alerting for suspicious HTTP requests to the SafeMacFilter function parameter. Within 30 days: Request patch timeline from Tenda; if no patch released within 60 additional days, initiate replacement with a current-generation router model.

Tenda PW201A CVE-2026-36802

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Denial Of Service Buffer Overflow Tenda N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:29 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the SafeMacFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda PW201A v1.0.5 routers allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the page parameter of the SafeMacFilter function. EPSS scores exploitation probability at just 0.02% (4th percentile), and no public exploit identified at time of analysis, though a research repository on GitHub references the vulnerable function.

Technical ContextAI

The Tenda PW201A is a consumer/SOHO powerline wireless router from Shenzhen Tenda Technology. The flaw resides in the SafeMacFilter function, part of the device's web-based administrative HTTP interface used to configure MAC address filtering rules. The root cause is CWE-120 (Classic Buffer Copy without Checking Size of Input): the page parameter received via an HTTP request is copied into a fixed-size buffer without bounds validation, corrupting adjacent stack/heap memory and crashing the embedded httpd process. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a) indicating no formal CPE has been published yet, so affected platforms must be inferred from the description.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a security advisory or updated firmware for PW201A v1.0.5 as referenced in the available data. Compensating controls: ensure the device's web administration interface is never exposed to the WAN (disable remote management in the router settings, which blocks external HTTP/HTTPS requests but is the default on most Tenda devices); restrict LAN-side access to the admin panel by isolating untrusted clients (IoT/guest VLAN) so they cannot reach the management IP, with the trade-off of more complex network configuration; monitor the router for unexplained reboots as an indicator of attempted exploitation. Given this is an end-of-life-class consumer device, consider replacing with a supported router if no firmware update appears. Track the research repository at https://github.com/xhh0124/SemVulLLM/tree/main/PW201A/SafeMacFilter and Tenda's security page for any future patch release.