CVE-2026-36773: Tenda W3 Router Stack Overflow Denial of Service

Technical summary

CVE-2026-36773 is a stack buffer overflow (CWE-121) in the ask_to_reboot function of the Tenda W3 router. The Go parameter fails to properly validate or bound input length before writing to stack memory, enabling stack corruption. An attacker with adjacent network access can trigger a crash by sending a malformed request containing an oversized Go parameter value. The vulnerability requires no authentication and no user interaction, making it trivial to exploit from any device on the same network segment.

Business impact

For organizations relying on Tenda W3 routers as network gateways or access points, this vulnerability introduces availability risk. An attacker could repeatedly crash the device, causing prolonged outages to dependent systems. In retail, hospitality, or small-office environments where internet uptime is critical, denial of service translates directly to revenue loss and customer experience degradation. The attack requires only network adjacency, not internet-level access, making it a concern primarily for internal threat actors, compromised devices on your network, or guests with network access.

Affected systems

Tenda W3 Wireless Router firmware version 1.0.0.3(2204) is confirmed vulnerable. Organizations should audit deployments of this specific model and firmware build. Verify whether your Tenda devices are running this exact version by accessing the router's administration interface. Determine whether any newer firmware versions are available directly from Tenda's support site and check release notes for security fixes.

Exploitability

Exploitability is straightforward for an attacker already on the same local network (adjacent network access per CVSS metrics). No authentication is required, no user interaction is needed, and the attack is deterministic—sending a malformed request reliably triggers the crash. However, the vulnerability is not remotely exploitable over the internet; the attacker must be on the LAN or have compromised another device on that network. This lowers the threat from external threat actors but elevates risk from insider threats or compromised guest devices.

Remediation

Contact Tenda support or visit their download center to obtain a firmware update for the W3 router that addresses CVE-2026-36773. Apply the patch to all affected units. If a firmware update is not immediately available, consider implementing network access controls to restrict which devices can reach the router's management interface, or temporarily isolate the affected router to a VLAN with limited trust.

Patch guidance

Obtain the latest firmware for the Tenda W3 from Tenda's official support portal, verifying you have the correct model and region-specific build. Back up your router configuration before upgrading. Follow Tenda's documented firmware update procedure (usually via the web admin console or dedicated update tool) and allow the device to fully reboot. After patching, confirm the new firmware version is reported correctly in the device settings and test basic connectivity to ensure no regression.

Detection guidance

Monitor Tenda router logs for repeated reset or crash events, particularly if correlated with unusual requests to the reboot function. Network-level detection is challenging since the trigger is a crafted HTTP or API request to an internal-only endpoint. Consider enabling verbose logging on the router if available. Host-based detection on systems dependent on the router (elevated latency, connection drops) may indicate an active attack. Periodically verify the firmware version across all Tenda devices in inventory to identify unpatched units.

Why prioritize this

Although the CVSS score is medium (6.5) and the vulnerability does not enable data theft or code execution, it represents a direct availability threat to critical network infrastructure. For environments where router uptime is operationally essential, denial of service on a network gateway is effectively a critical impact event. Prioritize patching if your organization depends on this router for production traffic; deprioritize only if the device is isolated, redundant, or used for non-critical purposes.

Risk score, explained

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects: Attack Vector (Adjacent network) limits exposure to same LAN only; Attack Complexity (Low) indicates the crash is reliable and easy to trigger; Privilege Required and User Interaction (None) show no barriers to exploitation; Scope (Unchanged) and Confidentiality/Integrity (None) indicate no data breach or system compromise; Availability (High) confirms severe disruption. The medium severity reflects the local-only attack surface offsetting the complete availability impact.

Frequently asked questions