A stack-based buffer overflow exists in the /goform/exeCommand HTTP endpoint of Tenda W3 routers. The vulnerability is triggered by an overlong cmdinput argument, allowing an attacker to corrupt the stack and potentially execute arbitrary code or crash the device. The flaw is rooted in unsafe string handling and buffer boundary checks.

The issue affects Tenda W3 models running firmware version 1.0.0.3(2204). No other firmware versions or devices are reported as affected. The vulnerability is limited to the HTTP Handler component handling the formexeCommand function, accessible through the router’s web interface.

The CVSS score of 8.7 demonstrates high severity, while the EPSS score of less than 1% indicates that exploit attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread known exploitation. Attackers can reach the vulnerable endpoint from any remote host on the network, sending crafted HTTP requests to trigger the overflow. To mitigate this, users should promptly apply any vendor-published firmware updates and promptly block or disable remote access to the affected endpoint if an update is unavailable.