CVE-2026-3976

A weakness has been identified in Tenda W3 1.0.0.3(2204). Impacted is the function formWifiMacFilterSet of the file /goform/WifiMacFilterSet of the component POST Parameter Handler. Executing a manipulation of the argument index/GO can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-formWifiMacFilterSet-go-buffer-overflowExploit, Third Party Advisory
• https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-formWifiMacFilterSet-index-buffer-overflowExploit, Third Party Advisory
• https://vuldb.com/?ctiid.350411Permissions Required, VDB Entry
• https://vuldb.com/?id.350411Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769179Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769180Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39715Missing Authorization vulnerability in AnyTrack AnyTrack Aff…5.3
• CVE-2026-39716Missing Authorization vulnerability in CKThemes Flipmart fli…5.3
• CVE-2026-3972A vulnerability was found in Tenda W3 1.0.0.3(2204). Affecte…8.8
• CVE-2026-3973A vulnerability was determined in Tenda W3 1.0.0.3(2204). Th…8.8
• CVE-2026-3974A vulnerability was identified in Tenda W3 1.0.0.3(2204). Th…8.8
• CVE-2026-3975A security flaw has been discovered in Tenda W3 1.0.0.3(2204…8.8
• CVE-2026-3977A security vulnerability has been detected in projectsend up…6.3
• CVE-2026-3978A vulnerability was detected in D-Link DIR-513 1.10. The imp…8.8
• CVE-2026-3979A flaw has been found in quickjs-ng quickjs up to 0.12.1. Th…5.3
• CVE-2026-3980A vulnerability has been found in itsourcecode Online Doctor…9.8
• CVE-2026-39803Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-39804Allocation of Resources Without Limits or Throttling vulnera…8.2