CVE-2026-3974 | Tenda W3 1.0.0.3(2204) HTTP /goform/exeCommand formexeCommand cmdinput stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the component HTTP Handler. Such manipulation of the argument cmdinput leads to stack-based buffer overflow.

This vulnerability is listed as CVE-2026-3974. The attack may be performed from remote. In addition, an exploit is available.