CVE-2026-3974 HIGH

CVE-2026-3974: Tenda W3 HTTP exeCommand formexeCommand stack-based overflow

Vendor Tenda

Product W3

Weakness CWE-121

Published March 12, 2026

Last update March 12, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the component HTTP Handler. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.

Key dates

02Disclosure timeline

March 12, 2026 CVE published

March 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3974 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2023-35745 D-Link DAP-2622 DDP Configuration Restore Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-3975 Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow CVE-2025-7085 Belkin F9K1122 webs formiNICWpsStart stack-based overflow CVE-2024-4291 Tenda A301 setBlackRule formAddMacfilterRule stack-based overflow CVE-2024-0533 Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflow