CVE-2026-4007
Published: 12 March 2026
Summary
CVE-2026-4007 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4007 is a stack-based buffer overflow vulnerability in the Tenda W3 router running firmware version 1.0.0.3(2204). The issue resides in unknown code within the /goform/wifiSSIDget file of the POST Parameter Handler component, where manipulation of the "index" argument triggers the overflow. Associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write), it was published on 2026-03-12 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers who possess low privileges, such as an authenticated user on the device. By sending a specially crafted POST request targeting the "index" parameter, an attacker can trigger the buffer overflow, potentially leading to arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Advisories on VulDB (ctiid.350530, id.350530, submit.769181) document the vulnerability details, while a GitHub repository (Svigo-o/Tenda_vul/tree/main/tenda-w3-formwrlSSIDget-index-buffer-overflow) hosts a public exploit that may be used. The Tenda website (tenda.com.cn) is referenced, but no specific patch or mitigation details are outlined in the provided sources.
The exploit is publicly available, increasing the risk of active exploitation against unpatched Tenda W3 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11538
Vulnerability details
A vulnerability was detected in Tenda W3 1.0.0.3(2204). This vulnerability affects unknown code of the file /goform/wifiSSIDget of the component POST Parameter Handler. Performing a manipulation of the argument index results in stack-based buffer overflow. It is possible to initiate…
more
the attack remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web management interface (/goform/wifiSSIDget) enables remote authenticated RCE; directly maps to T1190 (public-facing web app exploitation) and T1068 (priv esc from low-priv web session to arbitrary code execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow by requiring timely application of vendor patches or firmware updates to eliminate the vulnerability in the POST parameter handler.
Memory protection implements safeguards like stack canaries, ASLR, and non-executable memory to prevent successful exploitation of the stack-based buffer overflow leading to arbitrary code execution.
Information input validation enforces bounds checking and sanitization of the 'index' POST parameter to prevent the improper restriction of operations causing the buffer overflow.