A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Parame…

A critical stack-based buffer overflow vulnerability (CVE-2026-3973) has been discovered in Tenda W3 router version 1.0.0.3(2204). The vulnerability affects the formSetAutoPing function in the /goform/setAutoPing endpoint of the POST Parameter Handler component. Attackers can exploit this vulnerability remotely by manipulating the ping1 or ping2 arguments to cause a stack-based buffer overflow. The exploit has been publicly disclosed and proof-of-concept code is available on GitHub. This vulnerability can be leveraged by remote attackers to potentially gain unauthorized access or execute arbitrary code on affected devices.