CVE-2026-36803 Overview
CVE-2026-36803 is a buffer overflow vulnerability affecting Shenzhen Tenda Technology Co., Ltd Tenda PW201A routers running firmware version v1.0.5. The flaw resides in the qossetting function, where the page parameter is processed without proper bounds checking. Remote attackers can trigger the overflow by sending a crafted HTTP request, causing the device to enter a Denial of Service (DoS) state. The vulnerability is classified under [CWE-120] Buffer Copy without Checking Size of Input. No authentication or user interaction is required to exploit the issue.
Critical Impact
Unauthenticated remote attackers can crash the router over the network using a single crafted HTTP request to the qossetting endpoint, disrupting connectivity for all downstream users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda PW201A
- Firmware version v1.0.5
- Earlier firmware revisions sharing the same qossetting handler may also be affected
Discovery Timeline
- 2026-06-09 - CVE-2026-36803 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36803
Vulnerability Analysis
The vulnerability exists in the qossetting function of the Tenda PW201A web management interface. The function processes the page HTTP request parameter and copies its contents into a fixed-size stack buffer without validating the length of the supplied data. When an attacker sends an oversized page value, the copy operation writes beyond the bounds of the destination buffer, corrupting adjacent stack memory and triggering a crash of the embedded HTTP daemon. A successful crash forces the router into a non-responsive state and interrupts network traffic for any clients depending on the device. Because the web management service typically runs with elevated privileges on embedded routers, the corruption affects core routing functionality.
Root Cause
The root cause is the absence of length validation on attacker-controlled input before performing a memory copy operation. The qossetting handler treats the page parameter as trusted and uses an unbounded copy routine, matching the pattern described in [CWE-120]. No canary or stack protection mechanism mitigates the resulting overflow on this firmware build.
Attack Vector
Exploitation requires only network access to the router's HTTP management interface. An attacker submits a crafted HTTP request containing an oversized page parameter targeting the qossetting endpoint. The request does not require credentials or user interaction. Where the management interface is reachable from the WAN, the device is exposed to unauthenticated internet-based attackers. On LAN-only deployments, any attacker with local network access — including a compromised client device — can reach the vulnerable endpoint. Public proof-of-concept material is available in the SemVulLLM GitHub Repository.
No verified exploit code is reproduced here. The vulnerability manifests when the page parameter in a POST or GET request to the qossetting handler exceeds the size of the destination stack buffer, producing a buffer overflow and crashing the HTTP service.
Detection Methods for CVE-2026-36803
Indicators of Compromise
- Unexpected reboots or hangs of the Tenda PW201A device following inbound HTTP requests
- HTTP requests to the qossetting endpoint containing abnormally long page parameter values
- Loss of routing or DHCP services correlated with web management interface activity
Detection Strategies
- Inspect HTTP traffic destined for the router's management interface and flag requests where the page parameter exceeds expected length thresholds
- Apply intrusion detection signatures that match oversized parameter values targeting /goform/qossetting or equivalent URIs
- Correlate router availability alerts with web management request logs to identify probable DoS attempts
Monitoring Recommendations
- Forward router syslog and uptime telemetry to a centralized logging platform and alert on unplanned reboots
- Monitor north-south traffic for HTTP requests to embedded management interfaces from untrusted source ranges
- Track repeated failed HTTP transactions to the router web service as a precursor to crash conditions
How to Mitigate CVE-2026-36803
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs and disable WAN-side administration
- Apply network-level access control lists blocking inbound HTTP and HTTPS traffic to the device from untrusted networks
- Audit Tenda PW201A deployments and identify all units running firmware v1.0.5
Patch Information
At the time of publication, no vendor advisory or fixed firmware release for Tenda PW201A is referenced in the available CVE data. Operators should monitor Tenda's official support channels for a security update addressing the qossetting handler and apply firmware updates immediately upon release.
Workarounds
- Place the router behind an upstream firewall and block external access to TCP ports used by the web management interface
- Disable remote web administration features in the router configuration if not strictly required
- Replace affected PW201A units with supported hardware in environments where a vendor patch is unlikely to be released
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
