CVE-2026-3973 - Vulnerability Details

- Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflow

Description

A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Parameter Handler. This manipulation of the argument ping1/ping2 causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Published: 2026-03-12

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A stack-based buffer overflow exists in the formSetAutoPing function in the Tenda W3 firmware 1.0.0.3(2204). Manipulating the POST parameters ping1 or ping2 over the /goform/setAutoPing endpoint causes a buffer overflow on the stack, potentially allowing an attacker to execute arbitrary code or crash the device. The vulnerability is tied to classic buffer overrun weaknesses identified by CWE-119, CWE-121 and CWE-787.

Affected Systems

The affected device is the Tenda W3 router running firmware version 1.0.0.3(2204). No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests the current exploitation probability is low. The vulnerability can be triggered remotely by sending a crafted POST request to the management interface. The vendor has not catalogued this flaw as a known exploited vulnerability, but public exploit code has been disclosed and the flaw remains active.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Tenda

affected

Version	Status	Constraints
`1.0.0.3(2204)`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:tenda:w3_firmware:1.0.0.3\(2204\):*:*:*:*:*:*:*

cpe:2.3:h:tenda:w3:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Tenda

100%

Version	Status	Scheme	Platform
`1.0.0.3(2204)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the router to the latest firmware that addresses the buffer overflow.
If a newer firmware is not available, disable the AutoPing feature or block the /goform/setAutoPing endpoint from the internet.
Restrict management access to trusted internal IP addresses or use a firewall to limit exposure.
Monitor traffic to the router’s HTTP interface for unusual POST requests to /goform/setAutoPing.

Generated by OpenCVE AI on April 2, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00096.

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setautoping-ping1-buffer-overflow
https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setautoping-ping2-buffer-overflow
https://vuldb.com/?ctiid.350408
https://vuldb.com/?id.350408
https://vuldb.com/?submit.769173
https://vuldb.com/?submit.769176
https://www.tenda.com.cn/

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenda w3 Firmware
Weaknesses		CWE-787
CPEs		cpe:2.3:h:tenda:w3:-:::::::* cpe:2.3:o:tenda:w3_firmware:1.0.0.3\(2204\):::::::*
Vendors & Products		Tenda w3 Firmware

Thu, 12 Mar 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 12 Mar 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenda Tenda w3
Vendors & Products		Tenda Tenda w3

Thu, 12 Mar 2026 02:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Parameter Handler. This manipulation of the argument ping1/ping2 causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Title		Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflow
Weaknesses		CWE-119 CWE-121
References		https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setautoping-ping1-buffer-overflow https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setautoping-ping2-buffer-overflow https://vuldb.com/?ctiid.350408 https://vuldb.com/?id.350408 https://vuldb.com/?submit.769173 https://vuldb.com/?submit.769176 https://www.tenda.com.cn/
Metrics		cvssV2_0 `{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Tenda W3 W3 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-12T01:32:13.518Z

Updated: 2026-03-12T16:22:48.432Z

Reserved: 2026-03-11T14:01:21.742Z

Link: CVE-2026-3973

Vulnrichment

Updated: 2026-03-12T16:22:44.684Z

NVD

Status : Analyzed

Published: 2026-03-12T02:15:58.817

Modified: 2026-04-02T20:07:55.283

Link: CVE-2026-3973

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-03T09:39:35Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Exploitation poc

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object