A stack‑based buffer overflow exists in the Tenda W3 firmware 1.0.0.3(2204) when the POST parameter wifiSSIDget is supplied with a malicious index value. The overflow can be triggered remotely by sending a crafted HTTP request to the /goform/wifiSSIDget endpoint. If exploited, an attacker could corrupt the stack, potentially gaining arbitrary code execution or causing a denial of service. The weakness falls under the common weaknesses CWE‑119, CWE‑121 and CWE‑787.

The only affected product identified in the CNA data is Tenda W3, specifically the device running firmware version 1.0.0.3(2204). No other Tenda models or firmware revisions are listed as affected.

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild at present. The vulnerability is not cataloged in the CISA KEV listing, indicating no known public exploit has yet entered that registry. An attacker can exploit the flaw remotely over the network by directing a POST request to the management interface, which is insufficient to limit access. If an attacker succeeds, they could execute arbitrary code or crash the device, compromising confidentiality, integrity, and availability of the network it serves.