What is the CVSS score of CVE-2026-36809?

CVE-2026-36809 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36809?

Tenda W15E router firmware v15.11.0.10 contains a denial-of-service vulnerability allowing remote attackers to crash affected devices and disrupt network connectivity.

How to fix or mitigate CVE-2026-36809?

24 hours: Inventory all Tenda W15E deployments and confirm firmware versions across the organization. 7 days: Contact Tenda to confirm firmware patch availability; implement network-level access controls via firewall rules restricting HTTP access to administrative interfaces. 30 days: Complete upgrade to patched firmware version when released by vendor, or execute replacement program for all affected units running v15.11.0.10 or earlier.

Tenda W15E CVE-2026-36809

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable HTTP handler with a single crafted request causes process crash; no confidentiality or integrity impact, availability high - matches the published vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:23 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E router firmware v15.11.0.10 allows remote attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%), but the network-reachable attack surface on a customer-premises router warrants timely mitigation. The flaw is limited to availability impact per the CVSS vector, with no confidentiality or integrity consequences claimed.

Technical ContextAI

The Tenda W15E is a wireless hotspot/enterprise gateway router commonly deployed in hotels, cafes, and small businesses. The vulnerable formModifyWebAuthWhiteUser handler is part of the device's embedded HTTP management interface, which implements a captive-portal/web-authentication whitelist feature where webAuthWhiteID identifies a whitelisted user record. The root cause maps to CWE-120 (classic buffer copy without checking size of input): the handler copies attacker-controlled webAuthWhiteID data into a fixed-size stack or BSS buffer without bounds validation, corrupting adjacent memory and causing the httpd/web management process to crash. This pattern is recurrent across Tenda's MIPS-based SOHO firmware family, which uses unsafe C string routines (strcpy/sprintf) throughout its web CGI binaries.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory in the supplied references, and only a research repository (https://github.com/xhh0124/SemVulLLM/tree/main/W15E/formModifyWebAuthWhiteUser) is linked. Operators should check tendacn.com/en for an updated W15E firmware release beyond v15.11.0.10 and apply it once available. In the interim, restrict access to the device's web management interface to a trusted management VLAN or specific admin IPs via ACL, and explicitly disable any remote/WAN-side administration option (trade-off: admins lose off-LAN management convenience). If the captive-portal/web-auth whitelist feature is not used, disabling it removes the formModifyWebAuthWhiteUser endpoint from the attack surface, at the cost of losing per-user authentication exemption capability. Place the device behind an upstream firewall that drops inbound HTTP/HTTPS to the router's management port from untrusted networks.