CVE-2026-36791 Overview
CVE-2026-36791 is a stack overflow vulnerability affecting Shenzhen Tenda Technology Co., Ltd Tenda O3v3 router firmware version v1.0.0.5. The flaw resides in the save_list_data parameter of the formSetCfm function. Unauthenticated remote attackers can trigger the condition by sending a crafted HTTP request to the device, causing a Denial of Service (DoS). The weakness is classified under [CWE-121] (Stack-based Buffer Overflow). No vendor patch information is published in the available references, and no public exploitation has been confirmed by CISA KEV.
Critical Impact
An unauthenticated network attacker can crash the affected Tenda O3v3 device with a single crafted HTTP request, disrupting connectivity for all downstream users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda O3v3
- Firmware version v1.0.0.5
- HTTP management interface exposing formSetCfm
Discovery Timeline
- 2026-06-09 - CVE-2026-36791 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36791
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow [CWE-121] in the formSetCfm handler of the Tenda O3v3 web management daemon. The handler processes the save_list_data HTTP parameter and copies its contents into a fixed-size stack buffer without enforcing proper length validation. When an attacker supplies an oversized value, the copy operation overruns the buffer boundary and corrupts adjacent stack memory, including the saved return address. The result is an immediate crash of the web service, producing a Denial of Service condition that disrupts router availability. The attack requires no authentication and no user interaction, and it can be reached over the network through the HTTP interface.
Root Cause
The root cause is the absence of bounds checking on attacker-controlled input before it is written to a fixed-length stack buffer inside formSetCfm. The function trusts the size of save_list_data from the HTTP request body without truncation or validation against the destination buffer.
Attack Vector
An attacker reachable from the network sends a single crafted HTTP POST request to the router's management endpoint, supplying an oversized save_list_data value. The malformed parameter overflows the stack buffer and crashes the daemon. Refer to the GitHub PoC Repository for proof-of-concept details.
// No verified exploit code available - see referenced PoC repository for technical details
Detection Methods for CVE-2026-36791
Indicators of Compromise
- Unexpected reboots or crashes of the Tenda O3v3 web management process following inbound HTTP requests.
- HTTP POST requests to endpoints invoking formSetCfm that contain abnormally large save_list_data values.
- Loss of HTTP management interface availability while the device remains powered.
Detection Strategies
- Inspect HTTP traffic destined for the router for requests targeting formSetCfm with save_list_data parameter lengths exceeding expected sizes.
- Correlate router availability loss with preceding HTTP requests from external or untrusted source addresses.
- Deploy network-based intrusion detection signatures that match oversized POST bodies against the management interface.
Monitoring Recommendations
- Enable syslog forwarding from the device to a centralized logging platform to capture daemon restarts.
- Alert on repeated HTTP 5xx responses or connection resets from the router's management port.
- Track ICMP reachability for the device to identify availability degradation tied to exploitation attempts.
How to Mitigate CVE-2026-36791
Immediate Actions Required
- Restrict access to the Tenda O3v3 HTTP management interface so only trusted management hosts on isolated VLANs can reach it.
- Disable remote (WAN-side) management on affected devices to remove the network attack surface.
- Monitor the vendor's support channels for a firmware update addressing formSetCfm input validation.
Patch Information
No vendor patch has been published in the available references for CVE-2026-36791. Operators should consult Shenzhen Tenda Technology Co., Ltd directly for firmware release notes covering Tenda O3v3 v1.0.0.5.
Workarounds
- Place the router's management interface behind a firewall rule that blocks HTTP access from untrusted networks.
- Replace affected Tenda O3v3 deployments with supported hardware where a fix is unavailable and exposure cannot be reduced.
- Segment the router from production networks until a vendor firmware update is applied.
# Example: restrict inbound HTTP access to the router management interface
iptables -A INPUT -p tcp --dport 80 -s <trusted_management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
