Executive Summary

CVE-2026-36803 is a buffer overflow vulnerability found in the Tenda PW201A v1.0.5 device, specifically in the qossetting function. It occurs when an attacker sends a crafted HTTP request with a very long "page" parameter to a specific CGI endpoint. This parameter is processed unsafely using a sprintf command, which leads to a buffer overflow.

This buffer overflow can cause the device's process to crash or become unstable.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a Denial of Service (DoS). An attacker exploiting this flaw can cause the affected device to crash or become unstable, potentially disrupting network connectivity or device availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted HTTP request to the vulnerable device's CGI endpoint that triggers the buffer overflow in the qossetting function. Specifically, sending a request with a very long "page" parameter (e.g., page=a repeated 888 times or more) to the endpoint associated with the function 0x42e1c4 in the TENDA_HTTPD service can reveal the vulnerability if the device crashes or becomes unstable.

A possible detection command using curl could be:

• curl -v "http://<device-ip>/cgi-bin/qossetting?page=$(python3 -c 'print("a"*888)')"

If the device crashes, becomes unresponsive, or the HTTP service stops responding after this request, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include limiting access to the vulnerable device's HTTP management interface to trusted networks only, such as by using firewall rules or network segmentation.

Additionally, monitoring for unusual HTTP requests with abnormally long parameters targeting the qossetting function can help detect exploitation attempts.

Since the vulnerability causes a Denial of Service via a crafted HTTP request, blocking or filtering such malformed requests at the network perimeter or using an intrusion prevention system can reduce risk.

Finally, check for firmware updates or patches from Shenzhen Tenda Technology Co., Ltd and apply them once available to fully remediate the vulnerability.

Useful 0 Not Useful 0