Executive brief
The Tenda O3 Wireless Router, used for long-range outdoor wireless networking, contains a security flaw in its web management interface. By sending a specially crafted web request to the device, an attacker can cause the router to crash or reboot. This results in a denial of service, disrupting internet connectivity and network operations for all connected users.
Technical details
Multiple stack-based buffer overflows exist in the 'fromVirtualSer' CGI handler of the Tenda O3 router (firmware v1.0.0.5). The vulnerability is located in the 'fromVirtualSer' function, where user-supplied parameters (puVar2, puVar1, __s2, __s1_00, and puVar3) are retrieved via 'websGetVar' and subsequently passed to 'sprintf' without length validation. An attacker can exploit this by sending a crafted HTTP request with overly long strings in these parameters to overwrite the stack. While the primary reported impact is a Denial of Service (DoS) through device crashes, stack exhaustion of this nature often carries a risk of arbitrary code execution. The vulnerability is reachable over the network via the web management interface.
Affected products
- Tenda O3 Wireless Router v1.0.0.5(4180)
Timeline
- 2026-03-10: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure
- 2026-06-09: advisory: NVD published date