CVE-2026-3972
Published: 12 March 2026
Summary
CVE-2026-3972 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W3 Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 48.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3972 is a stack-based buffer overflow vulnerability affecting the Tenda W3 router on firmware version 1.0.0.3(2204). The flaw resides in the formSetCfm function within the /goform/setcfm file of the HTTP Handler component, where manipulation of the funcpara1 argument triggers the overflow. Published on 2026-03-12, it is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write), earning a CVSS v3.1 base score of 8.8.
Exploitation requires adjacency to the local network (AV:A) and is low complexity (AC:L) with no authentication (PR:N) or user interaction (UI:N) needed in an unchanged scope (S:U). Successful attacks can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), such as remote code execution on the device.
Advisories from VulDB (ctiid.350407, id.350407, submit.769172) document the issue, while a proof-of-concept exploit is publicly available in a GitHub repository at https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-setcfm-funcpara1-buffer-overflow. The vendor's site at https://www.tenda.com.cn/ is referenced, but no specific patches or mitigations are detailed in the provided sources.
The exploit has been made public, increasing the risk for unpatched Tenda W3 devices on local networks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11503
Vulnerability details
A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only…
more
be performed from the local network. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a stack-based buffer overflow in the HTTP handler (/goform/setcfm) of a router's web management interface, enabling unauthenticated remote code execution from the local network (AV:A), directly facilitating exploitation of a remote service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching or firmware updates to remediate the specific stack-based buffer overflow in the formSetCfm function.
Enforces validation of the funcpara1 argument to prevent improper restriction of operations within memory bounds, directly countering CWE-119/121/787.
Provides memory safeguards like stack canaries to block unauthorized code execution from the stack buffer overflow exploitation.