CVE-2026-36794
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Tenda W3 router v1.0.0.3(2204) has multiple stack overflows in R7WebsSecurityHandler via username and password parameters, allowing attackers to cause DoS via crafted HTTP request.
Risk Assessment
Risk involves potential shutdown of the Tenda W3 router, disrupting network connectivity in small offices or homes.
Recommendation
Update Tenda W3 firmware to the latest version and restrict access to the administrative interface.
Other vulnerabilities in Tenda W3
See all- CVE-2026-36793High
Tenda W3 router v1.0.0.3(2204) has multiple stack overflows in formwrlSSIDset via mit_ssid and mis_ssid_index parameters, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36792High
Tenda W3 router v1.0.0.3(2204) has a stack overflow in the wl_radio parameter of formWifiRadioSet, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36773Medium
The Tenda W3 router version v1.0.0.3(2204) contains a stack overflow vulnerability in the Go parameter of the ask_to_reboot function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-36772Medium
The Tenda W3 router version v1.0.0.3(2204) contains a stack overflow vulnerability in the wl_radio parameter of the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-36771High
The Tenda W3 Wireless Router v1.0.0.3(2204) contains a stack overflow in the wl_radio parameter of the formwrlSSIDset function. An attacker can exploit this vulnerability by sending crafted input, leading to a Denial of Service (DoS).
Original NVD description (English source)
Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the R7WebsSecurityHandler function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.