What is the CVSS score of CVE-2026-36807?

CVE-2026-36807 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36807?

Tenda W15E routers (firmware v15.11.0.10) are vulnerable to a remote denial-of-service attack that requires no authentication, allowing attackers to crash affected devices via malformed HTTP…

How to fix or mitigate CVE-2026-36807?

Within 24 hours: Identify all Tenda W15E devices on the network and audit firmware versions; document critical dependencies on these devices. Within 7 days: Implement network-level compensating controls (restrict WAN access to management interfaces, isolate from critical systems, enable request logging). Within 30 days: Execute device replacement plan; coordinate with Tenda for patched firmware release timeline; evaluate migration to certified alternative routers.

Tenda W15E CVE-2026-36807

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated single crafted HTTP request to a network-reachable management endpoint causes only device crash, so AV:N/AC:L/PR:N/UI:N with availability-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:22 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E router firmware v15.11.0.10 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser handler. CVSS 7.5 reflects the network-reachable, no-auth attack path with high availability impact but no confidentiality or integrity loss, and EPSS is very low (0.01%) with no public exploit identified at time of analysis.

Technical ContextAI

The Tenda W15E is a SMB/enterprise wireless access router whose web administration interface exposes the formAddWebAuthUser endpoint, used to add web-authentication users for captive-portal style access control. The flaw is a classic CWE-120 unbounded buffer copy: input supplied through the webAuthUserPwd parameter is written into a fixed-size stack/heap buffer without length validation, corrupting adjacent memory and causing the httpd/web server process on the device to crash. The CPE provided by the source is the placeholder 'cpe:2.3:a:n/a:n/a:*' rather than an authoritative Tenda CPE, so the affected scope must be derived from the description text (W15E firmware v15.11.0.10).

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory in the supplied references. As compensating controls, restrict access to the W15E web management interface to trusted LAN segments only by disabling remote/WAN management in the device settings (trade-off: administrators lose remote configuration capability and must be on-LAN or VPN'd in), place the device behind an ACL or firewall rule that blocks inbound HTTP/HTTPS to its admin port from untrusted networks, and monitor for repeated POST requests to /goform/formAddWebAuthUser as a crash precursor. Operators should also subscribe to Tenda security bulletins and plan a firmware upgrade as soon as a fixed build is released; in higher-risk deployments, consider replacing the device with a model under active security support. See the research reference at https://github.com/xhh0124/SemVulLLM/tree/main/W15E/formAddWebAuthUser for trigger details useful in building detection signatures.