Description
A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component POST Parameter Handler. Performing a manipulation of the argument wl_radio results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-03-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stack-based buffer overflow triggered by an out-of-bounds write to the wl_radio argument in the Tenda W3 firmware's /goform/WifiMacFilterGet POST handler. The flaw is described as enabling attackers to overflow a local stack buffer, which can lead to arbitrary code execution on the router. The vulnerability maps to CWE-119 and CWE-121, indicating unsafe buffer usage and stack manipulation weaknesses.

Affected Systems

Affected are Tenda W3 routers running firmware version 1.0.0.3(2204). The known impacted product is explicitly the Tenda W3 platform; no other models or firmware revisions are listed.

Risk and Exploitability

The CVSS score of 8.7 reveals a high severity level. An EPSS score of less than 1% suggests a low overall probability of exploitation, though an exploit has been publicly released in the wild and can be launched remotely. The vulnerability is not listed in the CISA KEV catalog, indicating no known large-scale exploit reports, but the public exploit code and remote attack potential necessitate immediate attention.

Generated by OpenCVE AI on March 18, 2026 at 15:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update available from Tenda for the W3 router.
  • If no firmware update is available, restrict or disable external POST access to the /goform/WifiMacFilterGet endpoint, limiting it to trusted IP ranges.
  • Continuously monitor network traffic for anomalous POST requests to the wl_radio parameter and implement firewall rules to block suspicious activity.

Generated by OpenCVE AI on March 18, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Tenda w3 Firmware
Weaknesses CWE-787
CPEs cpe:2.3:h:tenda:w3:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:w3_firmware:1.0.0.3\(2204\):*:*:*:*:*:*:*
Vendors & Products Tenda w3 Firmware

Fri, 13 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda w3
Vendors & Products Tenda
Tenda w3

Thu, 12 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component POST Parameter Handler. Performing a manipulation of the argument wl_radio results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda W3 W3 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-12T14:44:15.372Z

Reserved: 2026-03-11T14:01:27.580Z

Link: CVE-2026-3975

cve-icon Vulnrichment

Updated: 2026-03-12T14:44:04.132Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-12T03:15:58.523

Modified: 2026-04-02T20:07:35.820

Link: CVE-2026-3975

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T15:36:09Z

Weaknesses