Executive brief
The Tenda W3 is a wireless router used to provide internet connectivity in home and small office environments. A security flaw in the router's web management interface allows an attacker to send a specially crafted request that crashes the device. This results in a denial-of-service, cutting off internet access for all connected users and potentially requiring a manual reboot to restore operations.
Technical details
A stack-based buffer overflow exists in the 'formwrlSSIDset' CGI handler of the Tenda W3 router (firmware v1.0.0.3(2204)). The vulnerability is located in the handling of the 'index' parameter, which is retrieved via 'websGetVar' and subsequently passed to 'sprintf' to construct a configuration key (e.g., 'wl2g.ssid%s.'). Because the 'index' parameter is attacker-controlled and lacks length validation before being written into a fixed-size stack buffer, a long input string triggers the overflow. An attacker can reach this code path by setting the 'wl_radio' parameter to '0'. While the primary impact is a crash leading to Denial of Service (DoS), stack exhaustion of this nature may theoretically allow for remote code execution.
Affected products
- Tenda W3 Wireless Router v1.0.0.3(2204)
Timeline
- 2026-03-04: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure
- 2026-06-09: advisory: NVD published date