CVE-2026-36803 identifies a buffer overflow vulnerability (CWE-120) in the qossetting function of Shenzhen Tenda Technology Co., Ltd Tenda PW201A firmware version 1.0.5. The vulnerability is triggered via the page parameter in an HTTP request, allowing an unauthenticated remote attacker to cause a denial of service by crashing the device or service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (DoS). No patch or vendor advisory is currently available, and no exploits have been reported in the wild.

Successful exploitation results in a denial of service condition on the affected device, disrupting normal operation and potentially causing downtime. There is no indication of confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network-level protections such as filtering or blocking suspicious HTTP requests targeting the qossetting function may help reduce exposure. Monitor vendor channels for updates and apply official patches once released.