CVE-2026-36771

Vulnerability

A stack-based buffer overflow vulnerability exists in the formwrlSSIDset CGI handler of Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) [1]. The vulnerability is triggered when the wl_radio parameter is set to 0. The index parameter is then used in a sprintf function without proper length validation, leading to a buffer overflow on the stack [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the formwrlSSIDset CGI endpoint. The request must include the wl_radio parameter set to 0 and an overly long value for the index parameter. This will cause the sprintf function to write beyond the bounds of a stack buffer [1].

Impact

Successful exploitation of this vulnerability allows an attacker to cause a Denial of Service (DoS) on the affected device. The specific impact beyond DoS is not detailed in the available references [1].

Mitigation

As of the available references, a fixed version and release date for Tenda W3 Wireless Router v1.0.0.3(2204) have not been disclosed. No workarounds are provided. The device is not listed as end-of-life or on the KEV catalog [1].