CVE-2026-3974

A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the component HTTP Handler. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-formexeCommand-cmdinput-buffer-overflowExploit, Third Party Advisory
• https://vuldb.com/?ctiid.350409Permissions Required, VDB Entry
• https://vuldb.com/?id.350409Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769177Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39713Missing Authorization vulnerability in mailercloud Mailerclo…5.3
• CVE-2026-39714Missing Authorization vulnerability in G5Theme G5Plus April …5.3
• CVE-2026-39715Missing Authorization vulnerability in AnyTrack AnyTrack Aff…5.3
• CVE-2026-39716Missing Authorization vulnerability in CKThemes Flipmart fli…5.3
• CVE-2026-3972A vulnerability was found in Tenda W3 1.0.0.3(2204). Affecte…8.8
• CVE-2026-3973A vulnerability was determined in Tenda W3 1.0.0.3(2204). Th…8.8
• CVE-2026-3975A security flaw has been discovered in Tenda W3 1.0.0.3(2204…8.8
• CVE-2026-3976A weakness has been identified in Tenda W3 1.0.0.3(2204). Im…8.8
• CVE-2026-3977A security vulnerability has been detected in projectsend up…6.3
• CVE-2026-3978A vulnerability was detected in D-Link DIR-513 1.10. The imp…8.8
• CVE-2026-3979A flaw has been found in quickjs-ng quickjs up to 0.12.1. Th…5.3
• CVE-2026-3980A vulnerability has been found in itsourcecode Online Doctor…9.8