CVE-2026-3973
Published: 12 March 2026
Summary
CVE-2026-3973 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3973 is a stack-based buffer overflow vulnerability affecting the Tenda W3 router on firmware version 1.0.0.3(2204). The flaw exists in the formSetAutoPing function of the POST Parameter Handler component at the /goform/setAutoPing endpoint, triggered by manipulation of the ping1 or ping2 arguments. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with low complexity and low privileges required, without user interaction. A remote attacker possessing low privileges, such as admin interface access, can trigger the buffer overflow to achieve high impacts on confidentiality, integrity, and availability, potentially leading to remote code execution.
VulDB advisories (ctiid.350408 and related entries) document the issue, while GitHub repositories provide publicly disclosed proof-of-concept exploits specifically targeting the ping1 and ping2 buffer overflows. No patches or vendor-specific mitigations are detailed in the references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11505
Vulnerability details
A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Parameter Handler. This manipulation of the argument ping1/ping2 causes stack-based buffer overflow. The attack is possible to be carried…
more
out remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the authenticated web endpoint (/goform/setAutoPing) of a network device directly enables remote exploitation of a public-facing application, resulting in RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of POST parameters like ping1 and ping2 to prevent stack-based buffer overflows from improper input handling.
Implements memory safeguards such as stack canaries, ASLR, and non-executable stacks to protect against exploitation of the stack-based buffer overflow.
Directs identification, reporting, and correction of the buffer overflow flaw in the formSetAutoPing function to eliminate the vulnerability.