Tenda W3 routers running firmware 1.0.0.3(2204) contain a stack‑based buffer overflow in the HTTP handler function formSetCfm. The flaw is triggered by submitting a specially crafted value in the funcpara1 argument to the /goform/setcfm URL. When triggered it can corrupt the execution stack and lead to arbitrary code execution on the device. Because the vulnerability resides in the HTTP interface only, impact is confined to devices that are reachable locally, but compromise would give an attacker full control of the router.

Affected product is the Tenda W3 wireless router. Only the firmware version 1.0.0.3(2204) is known to include the vulnerability. Other Tenda devices and firmware revisions are not mentioned in the data.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1 percent suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to first gain access to the local network to send the crafted request. The publicly disclosed exploit demonstrates the feasibility of the attack, but it requires local network connectivity and is therefore limited in scope.