The vulnerability is a stack-based buffer overflow caused by the Go parameter in the ask_to_reboot function of Tenda US_W3V1.0BR v1.0.0.3. The overflow can be triggered by a crafted input, leading the device to crash or reboot and thereby rendering it unavailable. This defect falls under CWE‑121 and can cause a denial of service on the affected device, impacting availability but not confidentiality or integrity.

The flaw affects Shenzhen Tenda Technology Co., Ltd devices running the US_W3V1.0BR firmware version 1.0.0.3. No other versions are explicitly listed as vulnerable, but earlier firmware revisions that include the ask_to_reboot function may also be affected if they contain similar code.

The CVSS score of 7.5 indicates a high severity for the likely impact of a denial of service. With no EPSS data available and the vulnerability not flagged in the CISA KEV catalog, the exploitation probability is unclear but could be moderate if attackers discover the exposed interface. The attack requires sending a crafted parameter to the vulnerable function; the path and prerequisites are not fully detailed, so it is inferred that attackers need access to the device’s management interface or a network path that allows reaching the ask_to_reboot endpoint.