CVE-2026-3971
Stack-Based Buffer Overflow in Tenda i3 WiFiSSIDset Allows Remote Exploit
Publication date: 2026-03-12
Last updated on: 2026-04-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | i3_firmware | 1.0.0.6(2204) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3971 is a stack-based buffer overflow vulnerability found in the Tenda i3 router firmware version 1.0.0.6(2204). It exists in the function formwrlSSIDset, which is accessed via the /goform/wifiSSIDset HTTP endpoint.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the router\'s firmware does not properly validate the length of certain parameters, specifically the "index" and "GO" parameters, in HTTP POST requests sent to this endpoint.'}, {'type': 'paragraph', 'content': 'An attacker can exploit this by sending a crafted POST request with an excessively long string in either the "index" or "GO" parameter, causing a stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'This overflow can lead to denial of service or potentially allow the attacker to execute arbitrary code remotely on the device.'}] [1, 2, 3, 4, 5]
How can this vulnerability impact me? :
This vulnerability can have serious impacts on the affected device and network security.
- Denial of Service (DoS): An attacker can cause the router to crash or become unresponsive by triggering the buffer overflow.
- Remote Code Execution: The attacker may be able to execute arbitrary code on the router remotely, potentially gaining control over the device.
- Compromise of Confidentiality, Integrity, and Availability: Since the attacker can execute code remotely, they could intercept, modify, or disrupt network traffic passing through the router.
- No authentication or user interaction is required for exploitation, making it easier for attackers to exploit this vulnerability remotely.
Because of these impacts, the vulnerability poses a high risk to users relying on the affected Tenda i3 router firmware.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests sent to the /goform/wifiSSIDset endpoint on the Tenda i3 router firmware version 1.0.0.6(2204). Specifically, detection involves identifying unusually long or malformed values in the "index" or "GO" parameters, which are exploited to trigger the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': "A practical detection method is to capture and analyze network traffic targeting the router's HTTP daemon, looking for POST requests with excessively long payloads in these parameters."}, {'type': 'paragraph', 'content': 'Example commands using curl to test for the vulnerability by sending crafted POST requests with long "index" or "GO" parameters are as follows:'}, {'type': 'list_item', 'content': 'curl -X POST http://[router_ip]/goform/wifiSSIDset -d "index=$(python3 -c \'print("A"*1000)\')"'}, {'type': 'list_item', 'content': 'curl -X POST http://[router_ip]/goform/wifiSSIDset -d "GO=$(python3 -c \'print("A"*1000)\')"'}, {'type': 'paragraph', 'content': "These commands send an overly long string of 'A' characters to the vulnerable parameters, which can help detect if the device is susceptible by observing any abnormal behavior such as crashes or denial of service."}] [1, 3, 4, 5]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Currently, there are no known official patches or mitigations available for this vulnerability in the Tenda i3 router firmware version 1.0.0.6(2204).'}, {'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': "Restrict access to the router's management interface by limiting it to trusted networks or IP addresses."}, {'type': 'list_item', 'content': 'Disable remote management features if enabled, to prevent exploitation from external networks.'}, {'type': 'list_item', 'content': 'Monitor network traffic for suspicious POST requests targeting the /goform/wifiSSIDset endpoint with unusually long parameters.'}, {'type': 'list_item', 'content': 'Consider replacing the affected device with a more secure model or firmware version once available.'}, {'type': 'paragraph', 'content': 'Because the exploit is publicly available and the vulnerability is critical, these steps are essential to reduce the risk of remote exploitation.'}] [2]