CVE-2026-36784: Tenda O3 Router Stack Overflow Denial of Service

Technical summary

CVE-2026-36784 is a stack-based buffer overflow (CWE-121) in the fromNetToolGet function of the Tenda O3 router. The vulnerability stems from improper input validation on the ip parameter when processing HTTP requests. A malicious payload exceeding buffer boundaries can overwrite the stack, corrupting memory and crashing the device. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-based exploitability with no authentication barriers and high impact to availability.

Business impact

Organizations relying on Tenda O3 routers for network connectivity face potential service disruption if exploited. The denial-of-service condition can interrupt business operations until the router is manually rebooted. While confidentiality and integrity are not compromised, the availability impact is severe in environments where the router is a critical network component. This is particularly concerning for small office/home office (SOHO) deployments or remote locations with limited IT support.

Affected systems

Shenzhen Tenda Technology Tenda O3 Wireless Router firmware version 1.0.0.5(4180) is confirmed vulnerable. Other firmware versions and the O3 router line should be evaluated for similar exposure. Organizations should check their Tenda router models and firmware versions against Tenda's security advisories to determine scope of exposure within their environment.

Exploitability

The vulnerability carries high exploitability potential. No authentication is required, the attack complexity is low, and it can be executed over the network by any attacker with HTTP connectivity to the router's management interface. The flaw does not depend on user interaction. However, actual exploitation requires crafting a properly formatted HTTP request with a payload designed to overflow the ip parameter buffer—not a trivial attack but well within the capability of competent threat actors.

Remediation

Verify whether Tenda has released a patched firmware version for the O3 router addressing CWE-121 stack overflow in the fromNetToolGet function. Organizations should consult Tenda's official security advisory and firmware download portal. If patches are unavailable, consider network segmentation to restrict HTTP access to the router's management interface, deploying firewall rules to block suspicious traffic patterns, and evaluating alternative networking equipment if upgrades cannot be deferred.

Patch guidance

Contact Shenzhen Tenda Technology or visit their official support channels to obtain patched firmware for the O3 router. Verify patch availability specifically for firmware version 1.0.0.5(4180) or newer releases. Before deploying patches in production, test on non-critical equipment to ensure compatibility and stability. Document the baseline firmware version and backup configuration before initiating updates. Ensure proper power management during the update process to avoid incomplete flashing.

Detection guidance

Monitor HTTP traffic to router management interfaces for requests with unusual or oversized ip parameter values. Implement network intrusion detection rules to identify payloads attempting to exploit buffer overflows in web-based router management. Log all HTTP requests to the fromNetToolGet endpoint and baseline normal ip parameter sizes. Router access logs and syslog should be reviewed for crashes or restarts correlated with suspicious HTTP traffic. Employ network segmentation to isolate router management interfaces from untrusted network segments.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score (7.5), ease of exploitation (no authentication, low complexity), network-accessible attack vector, and impact on a critical network device. While not yet adopted for active exploitation in the wild (KEV status: false), the straightforward nature of the vulnerability and its position in network infrastructure creates significant risk. Organizations should prioritize assessment and remediation ahead of less accessible or complex vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility, lack of authentication requirements, low attack complexity, and severe impact to availability. The vector shows zero impact to confidentiality and integrity, limiting the score to availability damage. However, the ability for any network-connected attacker to crash a critical network device without preconditions justifies the elevated severity. This is not a critical-severity remote code execution, but represents a material risk to operational continuity.

Frequently asked questions