CVE-2026-36771: Tenda W3 Router Stack Overflow Denial of Service

Technical summary

CVE-2026-36771 is a stack buffer overflow (CWE-121) in the formwrlSSIDset function of the Tenda W3 router. The vulnerability exists in the wl_radio parameter handler, which fails to properly validate input length before writing to the stack. The flaw is remotely exploitable without authentication, leading to denial of service through application crash or potential code execution depending on exploitation sophistication. The CVSS 3.1 score of 7.5 (HIGH) reflects the high availability impact and zero network access barriers.

Business impact

Router downtime directly impacts business continuity for any organization relying on affected Tenda W3 units for internet connectivity. Repeated denial-of-service attacks could severely degrade network availability. In environments where this router handles critical access or serves multiple departments, exploits could cost significant productivity. The attack requires no authentication, meaning any upstream network attacker or compromised device can initiate an outage.

Affected systems

Tenda W3 Wireless Router firmware version 1.0.0.3 build 2204 is confirmed vulnerable. Organizations should audit their network for this specific model and firmware revision. Older or newer firmware builds of the W3 may or may not be affected; verification against Tenda's advisory is required.

Exploitability

This vulnerability is network-accessible and requires no authentication, making it relatively straightforward to exploit from any device with network access to the router's IP. Crafting the malicious wl_radio input is straightforward once the vulnerable parameter is identified. Public exploit code may emerge; the vulnerability does not require user interaction on the device itself. The primary barrier is network connectivity to the router interface.

Remediation

Patch immediately to the latest firmware version provided by Tenda for the W3 router. If patched firmware is not yet available, implement network segmentation to restrict direct access to the router's management interface from untrusted networks. Consider deploying rate-limiting or access controls on the router configuration endpoint. Verify patch availability through Tenda's official support channels.

Patch guidance

Check Tenda's official website or your device's firmware update mechanism for the latest W3 router firmware release. Apply any available firmware update that addresses CVE-2026-36771. Document the current firmware version before updating to confirm your router is vulnerable. Test the patch in a non-production environment first if possible. Tenda's advisory should specify the minimum patched firmware version; verify your upgrade reaches or exceeds that version.

Detection guidance

Monitor for HTTP/HTTPS requests to the router's web interface containing the wl_radio parameter with abnormally long or binary payloads. Observe for unexpected router reboots or unresponsive web interface access. Check router logs for configuration set errors correlating with DoS incidents. Network-based detection can look for POST requests to the SSID configuration endpoint with oversized or malformed parameters. Internal vulnerability scanners should flag the W3 on version 1.0.0.3(2204) if configured with those specifics.

Why prioritize this

The combination of zero-authentication network exploitability, confirmed denial-of-service impact, and HIGH severity warrants immediate attention. Any organization running this router model should prioritize patching. The lack of KEV inclusion should not reduce urgency—the technical factors alone justify rapid remediation given the direct availability impact.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity vulnerability due to: (1) Network accessibility with no authentication required (AV:N/PR:N), (2) Low attack complexity (AC:L), (3) High impact on availability (A:H), and (4) no confidentiality or integrity compromise in the baseline scenario. The score appropriately captures the practical risk to router availability while excluding speculative code-execution scenarios not confirmed in the vulnerability description.

Frequently asked questions