Tenda W3
CVE-2026-3972
HIGH
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only be performed from the local network. The exploit has been made public and could be used.
AnalysisAI
Stack-based buffer overflow in Tenda W3 firmware 1.0.0.3(2204) HTTP handler allows adjacent network attackers to achieve remote code execution without authentication. The vulnerability resides in the formSetCfm function's handling of the funcpara1 parameter at /goform/setcfm. Public exploit code is available on GitHub, though EPSS probability remains low at 0.03% (7th percentile), indicating limited real-world exploitation activity. CISA KEV does not list this vulnerability, suggesting no confirmed widespread or targeted exploitation campaigns.
Technical ContextAI
This is a classic stack-based buffer overflow (CWE-119) in embedded device firmware. The Tenda W3 is a wireless router, and the vulnerability affects its web management interface HTTP handler. When processing requests to the /goform/setcfm endpoint, the formSetCfm function fails to properly validate the length of the funcpara1 parameter before copying it to a fixed-size stack buffer. This allows an attacker to write beyond the allocated buffer boundary, corrupting adjacent stack memory including the return address. By carefully crafting the overflow payload, an attacker can hijack control flow and execute arbitrary code in the context of the web server process, typically with root/administrative privileges on embedded Linux-based router firmware. The CPE string identifies the exact affected firmware version as 1.0.0.3(2204) for Tenda W3 devices.
RemediationAI
No vendor-released patch identified at time of analysis. Tenda has not published a security advisory or updated firmware version addressing this vulnerability per available data. Compensating controls should be implemented immediately: First, disable HTTP/HTTPS management interface access from WiFi networks and restrict administrative access to wired Ethernet connections only via router configuration settings (trade-off: cannot manage device wirelessly). Second, ensure the web management interface is bound only to the LAN interface and not accessible from the WAN side (verify in Network Settings > Remote Management is disabled). Third, change default administrative credentials and implement strong passwords to prevent exploitation chains that might combine this with authentication bypass vulnerabilities. Fourth, place Tenda W3 devices behind a firewall that restricts Layer 2 adjacency to trusted network segments only. Fifth, monitor for abnormal POST requests to /goform/setcfm endpoints in web server logs. Consider replacing affected devices with alternative router models if Tenda does not release a patched firmware version. Advisory reference: https://vuldb.com/?id.350407
Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. Rated high sev
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attacke
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. Rated critic
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. Rated critical severity (CV
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. Rated critical se
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. Rate
Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /
In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWp
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today