This vulnerability arises from multiple stack overflows in the fromVirtualSer function of Tenda O3 routers, triggered by carefully crafted HTTP requests that manipulate the parameters puVar2, puVar1, __s2, __s1_00, and puVar3. The overflow conditions can corrupt the stack and cause the router to crash or become unresponsive, effectively denying access to the network device and the services it provides. As the impact is limited to availability, confidentiality and integrity are not directly compromised.

Shenzhen Tenda Technology Co., Ltd. Tenda O3 Wireless Router, firmware version 1.0.0.5 (build 4180). No other vendors or product versions are currently documented as affected.

The CVSS score is not available in the supplied data, and there is no EPSS score reported; the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is inferred to be remote network where an attacker sends a crafted HTTP request to the router’s management interface. Because the payload must reach the device over the local network or the internet, the likelihood of exploitation depends on the router’s exposure. While exact severity cannot be quantified without CVSS, the denial of service could disrupt network operations for any user relying on the router.