CVE-2026-36772: Tenda W3 Stack Overflow DoS Vulnerability – Patch Guidance

Technical summary

CVE-2026-36772 is a stack buffer overflow (CWE-121) in the formwrlSSIDget function of Tenda W3 firmware. The wl_radio parameter fails to validate input length before copying to a stack-allocated buffer, enabling classic stack smashing. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects attack surface limited to adjacent networks, but once reachable, exploitation is trivial and impacts only availability. The vulnerability does not appear to enable code execution or credential theft under standard conditions.

Business impact

For organizations deploying Tenda W3 routers—particularly in small offices, branches, or remote sites—this vulnerability creates an availability risk. An attacker with network adjacency can remotely trigger a device restart or hang without authorization, disrupting connectivity. In environments where the router serves critical functions (VPN gateway, guest network isolation, or network segmentation), repeated DoS attacks could degrade operations and require manual recovery.

Affected systems

Tenda W3 Wireless Router firmware version 1.0.0.3(2204) is confirmed vulnerable. Organizations should verify whether this specific firmware build is deployed in their network inventory. Tenda may have released patched versions; consult the vendor's security advisory and firmware repository to identify affected serial batches and available updates.

Exploitability

Exploitation is straightforward but geographically limited. An attacker must be on the same network segment (AV:A) or have routed access to the router's management interface. No authentication, user interaction, or complex exploitation primitives are required—a single malformed request triggers the overflow. The low attack complexity (AC:L) makes this practical for adversaries within network range. Remote exploitation from the internet is unlikely unless the router's web interface is exposed.

Remediation

Apply the latest firmware release from Tenda that patches the formwrlSSIDget stack overflow. Verify the patched firmware version against Tenda's official security advisory. As an interim control, restrict network access to the router's web interface using access control lists (ACLs), firewall rules, or device-level management VLANs to limit exposure to trusted administrators only. Monitor router logs and device status for unexpected restarts or anomalies.

Patch guidance

Visit Tenda's official support website and download the latest firmware for the W3 model. Before deploying to production, test patches in a non-critical environment to confirm functionality and compatibility with your network configuration. Schedule patching during a maintenance window to minimize service disruption during the router reboot cycle. Document the pre- and post-patch firmware versions for compliance and audit purposes.

Detection guidance

Monitor router logs for access attempts to the formwrlSSIDget endpoint or wl_radio parameter manipulation. Watch for unexpected device reboots, loss of connectivity, or firmware debug messages that may indicate exploitation attempts. Network intrusion detection systems (IDS) can flag anomalously long or malformed SSID configuration requests. Implement baseline monitoring of router uptime and CPU/memory status to detect repeated crash patterns that suggest active attack.

Why prioritize this

Although this is a MEDIUM-severity DoS vulnerability, it warrants prompt attention in environments where router availability directly affects business continuity. The local-network-only attack surface reduces overall risk compared to remotely exploitable flaws, but the trivial exploitation barrier and lack of authentication requirements mean any adjacent adversary can disrupt service. Prioritize patching in critical locations; lower-priority remote sites can follow standard patch cycles.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects the combination of easy exploitation (AV:A, AC:L, PR:N, UI:N) and high impact on availability (A:H), offset by the requirement for network adjacency and lack of confidentiality or integrity compromise. This scoring is appropriate for a local DoS without code execution potential. Organizations with extensive Tenda deployments should consider this score a floor; business risk may be higher in availability-critical contexts.

Frequently asked questions