A stack-based buffer overflow occurs in the Tenda W3 firmware 1.0.0.3(2204) when processing the POST /goform/wifiSSIDset endpoint. The vulnerability arises from improper handling of the index/GO argument, creating a buffer that overflows the stack. This weakness is identified as CWE-119 and CWE-121. The impact can include arbitrary code execution or a denial‑of‑service condition on the affected device due to the corrupted stack.

The affected device is the Tenda W3 wireless router. The specific firmware version identified as vulnerable is 1.0.0.3(2204). No other versions are listed in the available data.

The vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The description explicitly states that the attack can be launched remotely, indicating the attack vector is through network access to the router’s web interface via an HTTP POST request to /goform/wifiSSIDset. Published exploit code is available on GitHub, demonstrating that the flaw has been publicly exploited. The risk to impacted systems is significant, especially if the router is exposed to untrusted networks.