PT-2026-24906 · Tenda · W3+1

Svigo_O · Publicado 2026-03-12 · Atualizado 2026-03-12 · CVE-2026-3972

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda W3 version 1.0.0.3(2204)

Description A stack-based buffer overflow exists in the HTTP Handler component of Tenda W3 version 1.0.0.3(2204). The issue is located in the formSetCfm function within the /goform/setcfm file. Manipulation of the funcpara1 argument can trigger the overflow. The attack is limited to the local network. The exploit for this issue has been publicly released.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Stack Overflow

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-119

CWE-787

Identificadores relacionados

CVE-2026-3972

Produtos afetados

W3

W3 Firmware

Referências · 11

• 🔥 https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setcfm-funcpara1-buffer-overflow · Exploit
• https://tenda.com.cn · Nota
• https://t.me/CVEtracker/47213 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2032077101692838148 · Publicação no Twitter
• https://vuldb.com/?id.350407 · Nota
• https://vuldb.com/?submit.769172 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3972 · Nota de Segurança
• https://t.me/cveNotify/155214 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2031923486034198604 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2031992350243975366 · Publicação no Twitter
• https://vuldb.com/?ctiid.350407 · Nota