A stack overflow exists in the username parameter of the R7WebsSecurityHandler function in the firmware of Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router. By supplying a specially crafted HTTP request with an oversized or malformed username field, an attacker can trigger a buffer overflow that causes the device to crash and become unavailable. This flaw is a classic buffer overflow weakness, which compromises device stability but does not provide direct code execution capability.

The vulnerability affects the Tenda O3 Wireless Router running firmware version 1.0.0.5(4180). No other vendor or product versions are known to be impacted at this time.

The vulnerability can be exploited remotely over the Internet by sending a malicious HTTP request to the R7WebsSecurityHandler endpoint. Because the flaw causes a crash, it represents a high denial‑of‑Service risk to the network served by the router. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.9 indicates moderate severity, reflecting the impact on availability rather than confidentiality or integrity.