CVE-2026-3975
Stack-Based Buffer Overflow in Tenda W3 POST Parameter Handler
Publication date: 2026-03-12
Last updated on: 2026-04-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | w3_firmware | 1.0.0.3(2204) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3975 is a critical stack-based buffer overflow vulnerability found in the Tenda W3 router, version 1.0.0.3(2204).
The flaw exists in the POST parameter handler function formWifiMacFilterGet located at the endpoint /goform/WifiMacFilterGet.
Specifically, the vulnerability arises from improper handling of the wl_radio and index arguments, where an excessively long index value sent via a POST request causes a stack-based buffer overflow.
This overflow can lead to stack corruption, potentially allowing denial of service or arbitrary code execution on the device.
The vulnerability can be exploited remotely without authentication, making it highly accessible to attackers.
How can this vulnerability impact me? :
Exploitation of this vulnerability can compromise the confidentiality, integrity, and availability of the affected device.
An attacker can remotely trigger a stack-based buffer overflow, which may cause the device to crash (denial of service) or allow the attacker to execute arbitrary code.
This could lead to unauthorized control over the router, potentially allowing interception or manipulation of network traffic.
Since the exploit is publicly available and requires no authentication, the risk of attack is high.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unusual POST requests to the endpoint /goform/WifiMacFilterGet that include abnormally long or malformed values in the 'wl_radio' or 'index' parameters."}, {'type': 'paragraph', 'content': "A practical detection method is to capture and analyze network traffic for POST requests targeting /goform/WifiMacFilterGet with suspiciously large 'index' parameter values, which are used to trigger the stack-based buffer overflow."}, {'type': 'paragraph', 'content': 'For example, using curl or similar tools, you can simulate or detect such requests:'}, {'type': 'list_item', 'content': 'curl -X POST http://[router_ip]/goform/WifiMacFilterGet -d "index=$(python3 -c \'print("a"*1000)\')&wl_radio=1"'}, {'type': 'paragraph', 'content': "Monitoring logs or network intrusion detection systems (NIDS) for POST requests with unusually long 'index' parameters to this endpoint can help identify exploitation attempts."}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'There are no known mitigations or countermeasures available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda W3 router version 1.0.0.3(2204) with an alternative product that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restricting remote access to the router's management interface and monitoring for suspicious POST requests to /goform/WifiMacFilterGet may reduce exposure."}] [1]