CVE-2026-36793: Tenda W3 Router DoS Vulnerability

CVE-2026-36793 Overview

CVE-2026-36793 is a stack-based buffer overflow [CWE-121] affecting the Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router firmware version v1.0.0.3(2204). The vulnerability resides in the formwrlSSIDset function and is triggered through the mit_ssid and mis_ssid_index HTTP request parameters. A remote, unauthenticated attacker can send a crafted HTTP request to overflow stack memory and cause a Denial of Service (DoS) condition on the affected device.

Critical Impact
Remote, unauthenticated attackers can crash the router over the network using a single crafted HTTP request, disrupting wireless connectivity for all downstream clients.

Affected Products

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router
Firmware version v1.0.0.3(2204)
Devices exposing the web management interface to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-36793 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36793

Vulnerability Analysis

The Tenda W3 router exposes a web-based management interface that handles wireless configuration requests through the formwrlSSIDset handler. This function processes attacker-controllable parameters mit_ssid and mis_ssid_index from incoming HTTP requests without enforcing length validation before copying them into fixed-size stack buffers.

When the supplied parameter length exceeds the destination buffer capacity, adjacent stack memory is overwritten. This corrupts saved return addresses and frame pointers, causing the embedded web server process to crash. The router becomes unresponsive and wireless services remain unavailable until the device is rebooted.

The vulnerability requires no authentication, no user interaction, and is reachable over the network. The PoC referenced in the public GitHub PoC Repository targets the underlying function at offset FUN_00442b44.

Root Cause

The root cause is missing bounds checking on user-supplied HTTP parameters before they are written to stack-allocated buffers in formwrlSSIDset. The handler trusts the input length supplied by the client and uses unsafe string-copy routines on mit_ssid and mis_ssid_index values.

Attack Vector

An attacker on a network path to the router web interface can issue a single crafted HTTP POST request containing oversized mit_ssid or mis_ssid_index values. The malformed request triggers the stack overflow and crashes the HTTP service. Exploitation is reachable from the LAN, and from the WAN where remote administration is enabled.

No verified code example is available. The vulnerability mechanism is documented in the public PoC repository referenced above.

Detection Methods for CVE-2026-36793

Indicators of Compromise

Unexpected reboots or web management interface crashes on Tenda W3 devices
HTTP POST requests to SSID configuration endpoints containing abnormally long mit_ssid or mis_ssid_index values
Loss of wireless connectivity for clients without corresponding administrative action
Repeated TCP connection resets from the router management port following request bursts

Detection Strategies

Inspect HTTP request bodies on traffic destined for the router for mit_ssid and mis_ssid_index parameters exceeding typical SSID length limits (32 bytes)
Deploy intrusion detection signatures that match oversized POST parameters targeting the formwrlSSIDset endpoint
Correlate router availability monitoring with inbound HTTP request patterns to identify DoS attempts

Monitoring Recommendations

Enable syslog forwarding from the router to a central log collector to capture crash and reboot events
Monitor SNMP uptime counters for unexpected resets on Tenda W3 devices
Alert on inbound HTTP traffic to router management interfaces originating from untrusted network segments

How to Mitigate CVE-2026-36793

Immediate Actions Required

Restrict access to the Tenda W3 web management interface to trusted management hosts only
Disable remote (WAN-side) administration on affected devices
Place affected routers behind a network filter that blocks unsolicited HTTP requests from untrusted segments
Replace devices that no longer receive vendor firmware updates with supported hardware

Patch Information

No vendor advisory or patched firmware release has been published in the enriched data for CVE-2026-36793 at the time of writing. Consult the Shenzhen Tenda Technology support channel for firmware updates addressing the formwrlSSIDset stack overflow. Until a fix is released, treat the affected firmware version v1.0.0.3(2204) as vulnerable.

Workarounds

Segment the router management VLAN from user and guest networks using ACLs
Block external access to TCP ports used by the router web interface at the upstream firewall
Change default credentials and enforce strong authentication on the management interface, even though this vulnerability is pre-authentication, to limit secondary risk
Schedule automated availability checks so administrators are notified quickly if a DoS condition occurs

bash

# Example upstream firewall rule restricting router management access
iptables -A FORWARD -p tcp --dport 80 -d <router_ip> -s <management_subnet> -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d <router_ip> -j DROP
iptables -A FORWARD -p tcp --dport 443 -d <router_ip> -s <management_subnet> -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -d <router_ip> -j DROP