PT-2026-24930 · Tenda · Tenda W3

Svigo_O · Published 2026-02-27 · Updated 2026-03-13 · CVE-2026-4007

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda W3 version 1.0.0.3(2204)

Description A stack-based buffer overflow exists in the Tenda W3 version 1.0.0.3(2204). The issue is located in unknown code within the /goform/wifiSSIDget file of the POST Parameter Handler component. Manipulation of the index argument can trigger the buffer overflow, allowing for remote exploitation. The exploit is publicly available.

Recommendations Versions prior to 1.0.0.3(2204) are recommended.

Exploit

Fix

Stack Overflow

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-787

CWE-119

Related Identifiers

BDU:2026-04261

CVE-2026-4007

Affected Products

Tenda W3

References · 15

• 🔥 https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-formwrlSSIDget-index-buffer-overflow · Exploit
• https://bdu.fstec.ru/vul/2026-04261 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4007 · Security Note
• https://cve.org/CVERecord?idCVE-2026-4007 · Security Note
• https://vuldb.com/?ctiid.350530 · Note
• https://twitter.com/CVEnew/status/2031992326244221243 · Twitter Post
• https://tenda.com.cn · Note
• https://t.me/cveNotify/155237 · Telegram Post
• https://t.me/CVEtracker/47237 · Telegram Post
• https://vuldb.com/?submit.769181 · Note
• https://twitter.com/cyberbivash/status/2032013045455602020 · Twitter Post
• https://vuldb.com/?id.350530 · Note
• https://twitter.com/CVEarity/status/2032092451926868085 · Twitter Post
• https://twitter.com/EdgeDetectOps/status/2032343500797166061 · Twitter Post
• https://twitter.com/CveFindCom/status/2031999277052961194 · Twitter Post