What is the CVSS score of CVE-2026-3801?

CVE-2026-3801 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of I3 Firmware are affected by CVE-2026-3801?

A high-severity vulnerability (CVSS 8.8) has been identified in Tenda i3 routers that could allow attackers to compromise affected devices without requiring authentication.

Is there a public PoC exploit available for CVE-2026-3801?

Yes, a public proof-of-concept exploit is available for CVE-2026-3801. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3801?

Within 24 hours: Inventory all Tenda i3 1.0.0.6(2204) devices in your network and isolate affected units from critical systems. Within 7 days: Implement network segmentation to limit lateral movement from compromised routers and deploy WAF rules to block exploitation attempts. Within 30 days: Prepare migration plan to alternative router vendors and monitor Tenda security advisories daily for patch availability.

I3 Firmware CVE-2026-3801

HIGH

Buffer Overflow (CWE-119)

2026-03-09 cna@vuldb.com

Buffer Overflow Stack Overflow I3 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 09, 2026 - 16:14 vuln.today

Public exploit code

CVE Published

Mar 09, 2026 - 04:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formSetAutoPing of the file /goform/setAutoPing. Performing a manipulation of the argument ping1/ping2 results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda i3 1.0.0.6(2204) firmware allows authenticated remote attackers to achieve complete system compromise through manipulation of ping parameters in the setAutoPing function. Public exploit code exists for this vulnerability and no patch is currently available, creating significant risk for affected deployments.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects I3 Firmware. A vulnerability was found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formSetAutoPing of the file /goform/setAutoPing. Performing a manipulation of the argument ping1/ping2 results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.