What is the CVSS score of CVE-2026-36808?

CVE-2026-36808 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36808?

Tenda W15E router firmware v15.11.0.10 contains a denial-of-service vulnerability in the web administration interface that allows remote unauthenticated attackers to crash affected devices.

How to fix or mitigate CVE-2026-36808?

24 hours: Identify and inventory all Tenda W15E devices on the network using network scanning tools and device management systems. 7 days: Implement network segmentation to restrict web administration interface (default port 80/443) to authorized management VLANs only; consider disabling remote web administration if not required. 30 days: Monitor Tenda security advisories and vendor websites for firmware patches; establish testing protocol to validate firmware upgrades when available.

Tenda W15E CVE-2026-36808

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable HTTP endpoint, no auth or interaction required, single crafted request triggers crash; only availability impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:22 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E router firmware v15.11.0.10 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. EPSS is extremely low at 0.02% and no public exploit identified at time of analysis beyond a research repository, though the affected component is the web administration interface of a SOHO/SMB router.

Technical ContextAI

The flaw resides in formAddWebAuthUser, a handler in the Tenda W15E web management binary (typically the httpd/web server running on the router) that processes the webAuthUserInfo HTTP parameter used to add a web-authentication user. The root cause is CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input): the handler copies attacker-controlled input into a fixed-size stack or global buffer without bounds checking, corrupting adjacent memory and crashing the embedded httpd process. The W15E is an enterprise/SMB Wi-Fi router from Shenzhen Tenda; CPE data in NVD is a placeholder ('cpe:2.3:a:n/a:n/a') and does not formally enumerate the affected product, which is a recurring NVD-quality issue for Tenda CVEs from third-party MITRE submissions.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware in the supplied references. As compensating controls, restrict access to the router's web management interface to trusted LAN administrative hosts only and ensure WAN-side remote management is disabled (which is the default for most Tenda models but should be verified in System Tools / Remote Web Management); this blocks the network-reachable attack surface at the cost of requiring on-LAN access for administration. Place the device behind an upstream firewall or ACL that drops inbound TCP/80 and TCP/443 to the router's WAN IP, and monitor the device for unexpected reboots indicative of httpd crashes. If the device is end-of-life or no firmware update is forthcoming, plan migration to a supported model, and meanwhile consult https://github.com/xhh0124/SemVulLLM/tree/main/W15E/formAddWebAuthUser for the exact crashing payload pattern to build IDS/IPS signatures.