Is CVE-2026-36783 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36783 being exploited in the wild.

How severe is CVE-2026-36783?

Informational severity, with a CVSS score of 7.5, published 9 June 2026.

Which products and versions are affected?

Tenda O3 Wireless Router v1.0.0.5(4180).

Is there a fix for CVE-2026-36783?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36783 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-36783?

Check whether you run Tenda O3 Wireless Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36783: Tenda O3 Wireless Router stack overflow in fromNetToolGet

CVE-2026-36783 · Severity: info · CVSS 7.5 · Published 2026-06-09

The Tenda O3 Wireless Router, used for long-range outdoor wireless networking, contains a security flaw in its web management interface. An attacker can send a specially crafted web request to the device to trigger a system crash. This results in a denial of service, disrupting internet connectivity and network operations for all connected users.

Technologies: Tenda O3 Wireless Router. Vendors: Tenda.

Quick answers

Is CVE-2026-36783 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36783 being exploited in the wild.
How severe is CVE-2026-36783?: Informational severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?: Tenda O3 Wireless Router v1.0.0.5(4180).
Is there a fix for CVE-2026-36783?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36783 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-36783?: Check whether you run Tenda O3 Wireless Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the 'fromNetToolGet' CGI handler of the Tenda O3 router. The vulnerability is triggered when the 'domain' HTTP parameter, retrieved via 'websGetVar', is processed without adequate length validation before being used in a system command. Specifically, when the 'pingMode' is set to 'tranceroute' and 'hop' is set to 1, the 'domain' string is passed to 'doSystemCmd'. An attacker can exploit this by sending a crafted HTTP request to the web interface, leading to a process crash (DoS) or potentially arbitrary code execution via command injection or stack manipulation.

Affected products

Tenda O3 Wireless Router v1.0.0.5(4180)

Timeline

2026-03-12: other: CVE request submitted to MITRE
2026-06-06: disclosed: Public disclosure
2026-06-09: advisory: NVD published date

References

https://github.com/xhh0124/SemVulLLM/tree/main/O3/fromNetToolGet

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.