Executive brief
The Tenda O3 Wireless Router, used for long-range outdoor wireless networking, contains a security flaw in its web management interface. An attacker can send a specially crafted web request to the device to trigger a system crash. This results in a denial of service, disrupting internet connectivity and network operations for all connected users.
Technical details
A stack-based buffer overflow exists in the 'fromNetToolGet' CGI handler of the Tenda O3 router. The vulnerability is triggered when the 'domain' HTTP parameter, retrieved via 'websGetVar', is processed without adequate length validation before being used in a system command. Specifically, when the 'pingMode' is set to 'tranceroute' and 'hop' is set to 1, the 'domain' string is passed to 'doSystemCmd'. An attacker can exploit this by sending a crafted HTTP request to the web interface, leading to a process crash (DoS) or potentially arbitrary code execution via command injection or stack manipulation.
Affected products
- Tenda O3 Wireless Router v1.0.0.5(4180)
Timeline
- 2026-03-12: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure
- 2026-06-09: advisory: NVD published date