CVE-2026-3804
Stack-Based Buffer Overflow in Tenda i3 WifiMacFilterSet Allows Remote Attack
Publication date: 2026-03-09
Last updated on: 2026-03-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | i3_firmware | 1.0.0.6(2204) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3804 is a stack-based buffer overflow vulnerability found in the Tenda i3 router firmware version 1.0.0.6(2204). It exists in the function formWifiMacFilterSet, which handles requests to the /goform/WifiMacFilterSet HTTP endpoint.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the "index" parameter in HTTP POST requests is not properly validated for length. An attacker can send a crafted POST request with an excessively long "index" value, causing a buffer overflow on the stack.'}, {'type': 'paragraph', 'content': 'This flaw can be exploited remotely without local access, potentially leading to denial of service (DoS) or arbitrary code execution on the device.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to serious impacts on the affected device.
- Denial of Service (DoS) - The device may crash or become unresponsive.
- Arbitrary Code Execution - An attacker could execute malicious code remotely, potentially taking control of the device.
Such impacts compromise the confidentiality, integrity, and availability of the router and any network it protects.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious HTTP POST requests to the /goform/WifiMacFilterSet endpoint that contain an unusually long "index" parameter. Such requests may indicate attempts to exploit the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze network traffic targeting the Tenda i3 router, specifically looking for POST requests with the "index" parameter set to a very large string.'}, {'type': 'list_item', 'content': 'Use a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to /goform/WifiMacFilterSet.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <router_ip>) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)))'"}, {'type': 'list_item', 'content': 'Inspect captured HTTP POST payloads for the "index" parameter with abnormally long values.'}, {'type': 'list_item', 'content': 'Alternatively, use curl or similar tools to send crafted POST requests to test if the device is vulnerable by sending a large "index" parameter value.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint by limiting network exposure of the Tenda i3 router, such as placing it behind a firewall or disabling remote management if enabled.
Since no official patch or fix is available at the time of disclosure, it is recommended to replace the affected device with a non-vulnerable alternative to eliminate the risk.
Monitoring network traffic for exploit attempts and blocking suspicious requests targeting /goform/WifiMacFilterSet can help reduce the risk of exploitation.