Tenda W3 CVE-2026-3972

Attacker must have Adjacent Network access to the Tenda W3 device, meaning physical connection to the same Layer 2 network segment via wired Ethernet or association with the same WiFi network (CVSS AV:A). This specifically requires the attacker to be within WiFi range and authenticated to the wireless network, or physically connected to a LAN port on the router or any downstream switch. The web management interface must be accessible from the attacker's network position (default configurations typically expose the admin panel to all LAN/WiFi clients on the internal interface). No authentication to the web interface is required (PR:N) - the vulnerability triggers during parameter parsing before authentication checks. The formSetCfm function must be present and reachable at /goform/setcfm, which is confirmed in firmware version 1.0.0.3(2204). No user interaction required (UI:N). Exploitation is NOT possible from the internet/WAN side unless the management interface is specifically exposed to external networks via port forwarding or DMZ configuration (non-default). The adjacent network requirement significantly limits exploitation to scenarios where the attacker has already gained initial access to the local network perimeter.

While the CVSS 4.0 score of 7.4 appears concerning with high confidentiality, integrity, and availability impact, multiple risk signals suggest limited real-world threat. The CVSS vector indicates Adjacent Network access (AV:A) rather than full remote exploitation, meaning attackers must be on the same local network segment or WiFi network as the device. The EPSS score of 0.03% (7th percentile) is extremely low, indicating minimal observed exploitation activity in the wild. The vulnerability is not listed in CISA KEV, confirming no known active exploitation campaigns. However, the E:P metric indicates Proof-of-concept exploit code exists and is publicly available on GitHub, lowering the bar for exploitation. The PR:N (no privileges required) and AC:L (low complexity) factors mean any attacker who gains adjacent network access can exploit this without authentication. Primary risk scenarios include: compromised guest WiFi networks, insider threats, or attackers who have already pivoted to the local network via other means. For home users or small offices with default configurations exposing the web interface to WiFi clients, this represents a realistic privilege escalation/lateral movement risk rather than an internet-facing critical vulnerability.

An attacker connected to the same WiFi network as a Tenda W3 router (such as a guest network user or compromised IoT device on the LAN) sends a specially crafted HTTP POST request to http://[router-ip]/goform/setcfm with an oversized funcpara1 parameter value. The malicious payload overwrites the stack return address in the formSetCfm function, redirecting execution to attacker-controlled shellcode embedded in the buffer. The shellcode executes with the privileges of the web server process (typically root on embedded routers), allowing the attacker to install persistent backdoors, modify firewall rules, intercept traffic, or pivot to other devices on the network. Public proof-of-concept code at https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setcfm-funcpara1-buffer-overflow provides ready-made exploitation tools.