Cyber Posture

CVE-2026-3803

HighPublic PoC

Published: 09 March 2026

Published
09 March 2026
Modified
09 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3803 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda I3 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents stack-based buffer overflow by validating the manipulated 'index' argument in the formWifiMacFilterGet function.

prevent

Mitigates stack-based buffer overflow exploitation through memory protection mechanisms like stack canaries and address space randomization.

preventrecover

Addresses the vulnerability comprehensively by remediating the specific flaw in the Tenda i3 firmware via timely patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in public web management endpoint (/goform/WifiMacFilterGet) on network device allows remote unauthenticated/low-priv RCE, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in Tenda i3 1.0.0.6(2204). This affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly…

more

available and might be used.

Deeper analysisAI

CVE-2026-3803 is a stack-based buffer overflow vulnerability affecting the Tenda i3 router on firmware version 1.0.0.6(2204). The flaw exists in the formWifiMacFilterGet function, processed via the /goform/WifiMacFilterGet endpoint, where manipulation of the index argument triggers the overflow. Published on 2026-03-09, it is associated with CWE-119 and CWE-121.

Attackers can exploit this remotely over the network with low complexity and low privileges (PR:L), requiring no user interaction. The CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.

References include a public exploit on GitHub (https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-formWifiMacFilterGet-index-buffer-overflow) and VulDB advisories (https://vuldb.com/?ctiid.349770, https://vuldb.com/?id.349770, https://vuldb.com/?submit.768984), with the vendor site at https://www.tenda.com.cn/. The exploit is publicly available and might be used, but no specific mitigation or patch details are provided in the references.

The vulnerability carries notable risk due to the public exploit availability, increasing the likelihood of real-world abuse against exposed Tenda i3 devices.

Details

CWE(s)

Affected Products

tenda
i3 firmware
1.0.0.6\(2204\)

CVEs Like This One

CVE-2026-3804Same product: Tenda I3
CVE-2026-3802Same product: Tenda I3
CVE-2026-3799Same product: Tenda I3
CVE-2026-3801Same product: Tenda I3
CVE-2026-3970Same product: Tenda I3
CVE-2026-3971Same product: Tenda I3
CVE-2026-5841Same product: Tenda I3
CVE-2025-14992Same vendor: Tenda
CVE-2025-11527Same vendor: Tenda
CVE-2025-11326Same vendor: Tenda

References