Log in Start free

Vulnerability · Published Mar 12, 2026 · Assigned by VulDB

CVE-2026-3975Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in W3 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component POST Parameter Handler. Performing a manipulation of the argument wl_radio results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

VendorProductVersions
Tenda W3 1.0.0.3(2204)

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References