CVE-2026-36772 Overview
CVE-2026-36772 is a stack-based buffer overflow vulnerability in the Shenzhen Tenda Technology Tenda W3 Wireless Router, firmware version v1.0.0.3(2204). The flaw resides in the formwrlSSIDget function, which fails to validate the length of the wl_radio parameter before copying it onto the stack. Attackers on an adjacent network can submit crafted input to corrupt the stack and crash the router. The condition produces a Denial of Service (DoS), interrupting wireless connectivity for downstream clients. The weakness is classified under CWE-121: Stack-based Buffer Overflow.
Critical Impact
An attacker within wireless range can trigger a stack overflow in formwrlSSIDget to crash the Tenda W3 router, causing loss of network availability for all connected clients.
Affected Products
- Shenzhen Tenda Technology Co., Ltd. Tenda W3 Wireless Router
- Firmware version v1.0.0.3(2204)
- Devices exposing the formwrlSSIDget web management handler
Discovery Timeline
- 2026-06-09 - CVE-2026-36772 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36772
Vulnerability Analysis
The vulnerability exists in the formwrlSSIDget function within the Tenda W3 router's web management interface. This handler processes wireless configuration requests and reads the wl_radio parameter from user-supplied input. The function copies the parameter value into a fixed-size stack buffer without enforcing length validation. Submitting an oversized wl_radio value overflows adjacent stack memory, including saved return addresses and frame pointers. The result is a corrupted control flow that causes the HTTP service or the router itself to crash.
The attack vector is Adjacent Network, meaning the attacker must be on the same logical wireless or LAN segment as the device. No authentication or user interaction is required to reach the vulnerable handler. The current EPSS data reflects a low predicted exploitation probability, but a public proof-of-concept is referenced in a GitHub PoC Repository.
Root Cause
The root cause is missing bounds checking on the wl_radio request parameter inside formwrlSSIDget. The function trusts attacker-controlled input length and uses an unsafe copy operation into a stack-allocated buffer. This pattern is a classic [CWE-121] stack buffer overflow common to embedded SOHO router firmware.
Attack Vector
An unauthenticated attacker associated with the router's wireless network sends a crafted HTTP request to the management endpoint backed by formwrlSSIDget. The request includes an excessively long wl_radio parameter value. When the function processes the request, the stack buffer overflows and the embedded web server or device kernel terminates. Repeated submission sustains the DoS condition. Refer to the GitHub PoC Repository for technical reproduction details.
Detection Methods for CVE-2026-36772
Indicators of Compromise
- Unexpected reboots or web management service crashes on Tenda W3 routers running firmware v1.0.0.3(2204).
- HTTP POST requests to wireless configuration endpoints containing abnormally long wl_radio parameter values.
- Loss of wireless connectivity for clients shortly after receiving traffic from an unknown LAN or wireless peer.
Detection Strategies
- Inspect HTTP traffic to the router management interface for wl_radio parameter values exceeding expected lengths.
- Deploy network intrusion detection signatures that flag oversized form parameters targeting formwrlSSIDget.
- Correlate router availability monitoring with wireless association logs to identify adjacent attackers.
Monitoring Recommendations
- Enable syslog forwarding from the router to a central log collector and alert on repeated httpd restarts.
- Track wireless client association events and pair them with subsequent management-plane requests.
- Monitor uptime and ICMP availability of the router to detect DoS-induced reboots.
How to Mitigate CVE-2026-36772
Immediate Actions Required
- Restrict access to the router's web management interface to trusted wired hosts only.
- Disable remote and wireless management features on the Tenda W3 until a vendor patch is available.
- Segment guest and untrusted wireless clients onto isolated SSIDs that cannot reach the management plane.
- Replace affected devices in high-availability environments where DoS exposure is unacceptable.
Patch Information
No vendor advisory or firmware update has been published for CVE-2026-36772 at the time of NVD publication on 2026-06-09. Monitor the Tenda support portal for firmware revisions superseding v1.0.0.3(2204).
Workarounds
- Apply ACLs on the router to allow management-plane HTTP access only from designated administrative IP addresses.
- Enforce WPA2/WPA3 with strong pre-shared keys to limit which hosts can reach the adjacent network.
- Use a separate management VLAN that is not bridged to wireless SSIDs.
- Schedule periodic reboots and configuration backups to recover quickly from DoS events.
# Example: block management interface access from the wireless segment
iptables -I INPUT -i wlan0 -p tcp --dport 80 -j DROP
iptables -I INPUT -i wlan0 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
