CVE-2026-3972 Tenda W3 HTTP setcfm formSetCfm stack-based overflow
A stack-based buffer overflow in the Tenda W3 router's HTTP handler allows local network attackers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3972?
CVE-2026-3972 is a high-severity memory corruption vulnerability in Tenda W3, published on 12 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only be performed from the local network. The exploit has been made public and could be used.
Which versions are affected by CVE-2026-3972?
It affects 1 product.
Products include Tenda W3 Firmware.
How do I fix CVE-2026-3972?
No fix has been published for CVE-2026-3972 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3972 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3972 exists.
Other vulnerabilities in Tenda W3
- CVE-2026-3973 Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflow
- CVE-2026-3974 Tenda W3 HTTP exeCommand formexeCommand stack-based overflow
- CVE-2026-3975 Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow
- CVE-2026-3976 Tenda W3 POST Parameter WifiMacFilterSet formWifiMacFilterSet stack-based overflow
- CVE-2026-4007 Tenda W3 POST Parameter wifiSSIDget stack-based overflow
Sources
Also known as GHSA-j4r5-rc95-5xpf.