CVE-2026-36802 Overview
CVE-2026-36802 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 routers. The flaw resides in the page parameter handling within the SafeMacFilter function. A remote attacker can send a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS) condition on the affected device. The weakness is classified under CWE-120 (Classic Buffer Overflow). Exploitation requires no authentication and no user interaction, and the vulnerability is reachable over the network.
Critical Impact
Unauthenticated remote attackers can crash the Tenda PW201A router by sending a single crafted HTTP request to the SafeMacFilter endpoint, disrupting network availability.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5
- Affected component: SafeMacFilter function, page parameter
- Other firmware versions: Not Available
Discovery Timeline
- 2026-06-09 - CVE-2026-36802 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36802
Vulnerability Analysis
The Tenda PW201A web management interface exposes the SafeMacFilter function, which processes HTTP requests containing a page parameter. The function copies attacker-controlled data from this parameter into a fixed-size stack or heap buffer without enforcing length checks. When the supplied value exceeds the destination buffer size, adjacent memory is overwritten, leading to memory corruption and a process crash. The router service terminates and network services become unavailable until the device restarts.
The vulnerability is reachable from the network with no authentication required. Confidentiality and integrity remain intact, but availability is fully impacted, consistent with a DoS outcome rather than code execution. The Exploit Prediction Scoring System (EPSS) probability for CVE-2026-36802 is 0.254% as of 2026-06-11.
Root Cause
The root cause is missing input length validation in the SafeMacFilter handler. The function relies on unsafe string operations that do not bound the copy length to the destination buffer size, a textbook CWE-120 condition. This pattern is common in embedded SOHO router firmware where CGI handlers parse HTTP query parameters without sanitization.
Attack Vector
An attacker sends a single HTTP request to the router's web interface with an oversized value supplied for the page parameter routed to SafeMacFilter. No credentials are required. The request can be issued by any host able to reach the management interface, including LAN clients and, where the interface is exposed externally, internet-based attackers. Technical proof-of-concept material is available in the GitHub PoC Repository.
Detection Methods for CVE-2026-36802
Indicators of Compromise
- Unexpected reboots or service restarts of the Tenda PW201A router coinciding with inbound HTTP traffic to the management interface.
- HTTP requests targeting the SafeMacFilter endpoint that contain unusually long page parameter values.
- Loss of LAN or WAN connectivity following receipt of crafted HTTP traffic from untrusted sources.
Detection Strategies
- Inspect HTTP traffic destined for the router management interface for abnormally large page parameter values associated with SafeMacFilter.
- Correlate router availability loss events with firewall or IDS logs showing prior HTTP POST or GET activity to the device.
- Deploy network IDS signatures matching long parameter payloads sent to Tenda PW201A web endpoints.
Monitoring Recommendations
- Enable syslog forwarding from the router, where supported, to a central log store for crash and restart visibility.
- Monitor uptime metrics for the PW201A and alert on repeated unscheduled reboots.
- Restrict and log access to the router management interface from non-administrative network segments.
How to Mitigate CVE-2026-36802
Immediate Actions Required
- Block external access to the Tenda PW201A web management interface at the network perimeter.
- Restrict management interface access to a dedicated administrative VLAN or trusted IP allowlist.
- Disable remote administration features on the PW201A if not strictly required.
- Audit current Tenda PW201A firmware versions in the environment and identify devices running v1.0.5.
Patch Information
No vendor advisory or firmware patch from Shenzhen Tenda Technology was listed in the NVD record at the time of publication. Organizations should monitor the vendor's support portal for updated firmware addressing CVE-2026-36802 and apply it once available. Where a patch cannot be obtained, consider replacing affected devices with supported alternatives.
Workarounds
- Place the PW201A behind an upstream firewall that filters HTTP requests to the management port.
- Apply ACLs that deny HTTP traffic to the router from untrusted networks and only allow specific administrative hosts.
- Segment IoT and SOHO routing devices onto a network where a crash impacts only non-critical workloads.
# Example iptables rule to restrict router web management access to a trusted admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
