CVE-2026-3976
Published: 12 March 2026
Summary
CVE-2026-3976 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of POST parameters like index/GO to prevent stack-based buffer overflows from improper input handling.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of stack-based buffer overflows.
Requires timely remediation of the identified buffer overflow flaw through firmware patching to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in router web POST handler (/goform/WifiMacFilterSet) directly enables remote authenticated RCE via T1190 (Exploit Public-Facing Application); resulting arbitrary code execution on embedded Linux firmware maps to T1059.004 (Unix Shell).
NVD Description
A weakness has been identified in Tenda W3 1.0.0.3(2204). Impacted is the function formWifiMacFilterSet of the file /goform/WifiMacFilterSet of the component POST Parameter Handler. Executing a manipulation of the argument index/GO can lead to stack-based buffer overflow. It is possible…
more
to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2026-3976 is a stack-based buffer overflow vulnerability affecting the Tenda W3 router on firmware version 1.0.0.3(2204). The flaw resides in the formWifiMacFilterSet function within the /goform/WifiMacFilterSet file of the POST Parameter Handler component. It is triggered by manipulating the "index/GO" argument, as associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
The vulnerability enables remote exploitation with low attack complexity and no user interaction required. Attackers need low privileges (PR:L), such as those of an authenticated user, to submit a malicious POST request. Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8, potentially leading to arbitrary code execution on the device.
Advisories and references, including VulDB entries (ctiid.350411, id.350411, submit.769179), document the issue but do not specify patches or vendor mitigations in the provided details. GitHub repositories (Svigo-o/Tenda_vul) publicly host proof-of-concept exploits targeting the formWifiMacFilterSet index and GO buffer overflows.
The exploit code is publicly available, elevating the risk of widespread attacks against unpatched Tenda W3 devices. The vulnerability was published on 2026-03-12.
Details
- CWE(s)