CVE-2026-3975
Received Received - Intake
Stack-Based Buffer Overflow in Tenda W3 POST Parameter Handler

Publication date: 2026-03-12

Last updated on: 2026-04-02

Assigner: VulDB

Description
A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component POST Parameter Handler. Performing a manipulation of the argument wl_radio results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-12
Last Modified
2026-04-02
Generated
2026-06-16
AI Q&A
2026-03-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-3975
EUVD
EUVD-2026-11515
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tenda w3_firmware 1.0.0.3(2204)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-3975 is a critical stack-based buffer overflow vulnerability found in the Tenda W3 router, version 1.0.0.3(2204).

The flaw exists in the POST parameter handler function formWifiMacFilterGet located at the endpoint /goform/WifiMacFilterGet.

Specifically, the vulnerability arises from improper handling of the wl_radio and index arguments, where an excessively long index value sent via a POST request causes a stack-based buffer overflow.

This overflow can lead to stack corruption, potentially allowing denial of service or arbitrary code execution on the device.

The vulnerability can be exploited remotely without authentication, making it highly accessible to attackers.

Impact Analysis

Exploitation of this vulnerability can compromise the confidentiality, integrity, and availability of the affected device.

An attacker can remotely trigger a stack-based buffer overflow, which may cause the device to crash (denial of service) or allow the attacker to execute arbitrary code.

This could lead to unauthorized control over the router, potentially allowing interception or manipulation of network traffic.

Since the exploit is publicly available and requires no authentication, the risk of attack is high.

Compliance Impact

I don't know

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unusual POST requests to the endpoint /goform/WifiMacFilterGet that include abnormally long or malformed values in the 'wl_radio' or 'index' parameters."}, {'type': 'paragraph', 'content': "A practical detection method is to capture and analyze network traffic for POST requests targeting /goform/WifiMacFilterGet with suspiciously large 'index' parameter values, which are used to trigger the stack-based buffer overflow."}, {'type': 'paragraph', 'content': 'For example, using curl or similar tools, you can simulate or detect such requests:'}, {'type': 'list_item', 'content': 'curl -X POST http://[router_ip]/goform/WifiMacFilterGet -d "index=$(python3 -c \'print("a"*1000)\')&wl_radio=1"'}, {'type': 'paragraph', 'content': "Monitoring logs or network intrusion detection systems (NIDS) for POST requests with unusually long 'index' parameters to this endpoint can help identify exploitation attempts."}] [2, 3]

Mitigation Strategies

[{'type': 'paragraph', 'content': 'There are no known mitigations or countermeasures available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda W3 router version 1.0.0.3(2204) with an alternative product that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restricting remote access to the router's management interface and monitoring for suspicious POST requests to /goform/WifiMacFilterGet may reduce exposure."}] [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart