What is the CVSS score of CVE-2026-36803?

CVE-2026-36803 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda PW201A are affected by CVE-2026-36803?

A denial-of-service vulnerability in Tenda PW201A v1.0.5 routers (CVE-2026-36803) allows unauthenticated remote attackers to crash affected devices via a crafted HTTP request, creating network…

How to fix or mitigate CVE-2026-36803?

Within 24 hours: Inventory all Tenda PW201A v1.0.5 routers in production and implement firewall rules restricting HTTP management interface access to trusted administrative networks only. Within 7 days: Deploy network segmentation to isolate affected routers from untrusted network segments and establish a formal equipment replacement timeline. Within 30 days: Procure and deploy replacement network infrastructure or alternative secure remote management solutions that do not expose this vulnerable interface to untrusted network access.

Tenda PW201A CVE-2026-36803

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Denial Of Service Buffer Overflow Tenda N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:30 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda PW201A v1.0.5 routers allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that overflows a buffer in the page parameter of the qossetting function. EPSS is very low (0.02%, 4th percentile) and no public exploit identified at time of analysis beyond a research repository, but the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects easy network reachability against the router's web management interface. The flaw is not in CISA KEV.

Technical ContextAI

Tenda PW201A is a SOHO wireless router/access point; the qossetting function is part of its HTTP-based web administration interface that handles Quality-of-Service configuration. The root cause is CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input): the page parameter supplied in an HTTP request is copied into a fixed-size stack or heap buffer without bounds validation, corrupting adjacent memory and crashing the embedded httpd. The referenced researcher repository (SemVulLLM/PW201A/qossetting) suggests the issue was discovered via LLM-assisted firmware analysis of the router's web server binary. The CPE string in the input is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not include a proper hardware/firmware CPE for the PW201A, limiting machine-readable inventory matching.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware for CVE-2026-36803 in the supplied data. Until a firmware update is released, restrict access to the router's web administration interface: disable remote/WAN-side management entirely (most Tenda models expose this as 'Remote Web Management' and it should be Off), and on the LAN side limit admin UI access to a management VLAN or a small set of trusted IPs via the router's access-control list, accepting the trade-off that legitimate admins must connect from those sources. Where feasible, replace the PW201A with a supported model, since SOHO Tenda devices frequently accumulate unpatched httpd bugs of this class. Monitor the vendor page at tendacn.com for firmware later than v1.0.5 and the researcher reference https://github.com/xhh0124/SemVulLLM/tree/main/PW201A/qossetting for any proof-of-concept updates.