Tenda W15E
CVE-2026-36810
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach W15E HTTP portal interface
-
DeliveryCraft HTTP request with oversized gotoUrl parameter
-
ExploitSend request to formPortalAuth endpoint
-
ExecutionOverflow stack buffer in handler
-
ImpactCrash httpd process and deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the W15E's web interface that serves the captive portal authentication handler (formPortalAuth) over HTTP - typically TCP/80 on the LAN or management interface, or any interface where the portal is bound. The captive portal feature must be enabled and exposing formPortalAuth (default on W15E business-portal deployments). No authentication is required per CVSS PR:N and no user interaction is needed. Limiting factors: the W15E is a business AP/router not commonly exposed directly to the internet, so realistic exploitation usually requires LAN-side access or a misconfigured WAN-side management interface; only firmware v15.11.0.10 is explicitly confirmed vulnerable. |
| Impact | Signals are mixed but skew toward low priority for most operators. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) suggests trivially reachable remote DoS, but EPSS of 0.02% (4th percentile) indicates no observed exploitation interest and the CVE is not on CISA KEV. The referenced GitHub repository (SemVulLLM) appears to be an LLM-assisted vulnerability discovery research project rather than a weaponized exploit, so public exploit code exists in a research/PoC form but is not a turn-key tool. The realistic risk is therefore: any attacker with HTTP reachability to the portal interface can crash the device, but impact is limited to availability of a single SOHO/SMB device and there is no path to RCE or data disclosure per the assessed impact metrics. Note that buffer overflows are not always purely DoS - the affected vendor has not published an advisory confirming whether code execution is achievable, so the C:N/I:N rating could be optimistic. |
| Exploit ScenarioDerived | An attacker who can reach the W15E's captive portal HTTP endpoint - for example a guest on the same wireless network, or an internet attacker if the management/portal interface is exposed - sends a single crafted HTTP request to formPortalAuth with an oversized gotoUrl parameter, overflowing the stack buffer and crashing the httpd process. The result is loss of management access and, depending on watchdog behavior, possible loss of network connectivity for portal-authenticated users until the device reboots. A research PoC exists in the SemVulLLM GitHub repository, lowering the barrier for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Denial of service in Tenda W15E v15.11.0.10 routers can be triggered by remote unauthenticated attackers sending a crafted HTTP request that overflows the gotoUrl parameter in the formPortalAuth function. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and at the time of analysis no public exploit identified at time of analysis though a proof-of-concept research repository is referenced. EPSS is very low (0.02%, 4th percentile), suggesting limited real-world exploitation interest despite the network-reachable attack surface.
RemediationAI
No vendor-released patch identified at time of analysis - Shenzhen Tenda has not published an advisory or fixed firmware version in the available references. Operators should check the Tenda support portal (tendacn.com) for a firmware update newer than v15.11.0.10 and apply it once available. As compensating controls, restrict access to the device's HTTP management and captive portal interfaces to trusted management VLANs by configuring upstream ACLs or the device's own remote-management lockdown (trade-off: portal users on the LAN side may still reach the endpoint); if the captive portal feature is not used, disable it entirely in the W15E web UI to remove the vulnerable formPortalAuth code path (trade-off: loses guest authentication functionality); and place the device behind a reverse proxy or firewall that rate-limits and length-limits the gotoUrl query parameter (trade-off: requires inline infrastructure and may break legitimate long redirect URLs).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W15E is a small-business wireless access point/router with a captive portal authentication web interface. The vulnerable formPortalAuth handler is part of the device's embedded HTTP server (commonly httpd/goahead-derived in Tenda firmware) which processes portal authentication requests. The gotoUrl parameter - typically used to redirect users after portal login - is copied into a fixed-size stack buffer without proper bounds checking, matching CWE-120 (Classic Buffer Overflow). On the MIPS/ARM embedded targets typical for Tenda devices, oversized input corrupts the stack frame and crashes the httpd process, producing a denial of service; the CVSS vector (C:N/I:N/A:H) indicates impact is limited to availability rather than code execution in this assessment.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated HTTP request to portal handler (AV:N/AC:L/PR:N/UI:N); confirmed impact is httpd crash only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the gotoUrl parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
A denial-of-service vulnerability in Tenda W15E v15.11.0.10 routers allows unauthenticated remote attackers to trigger network outages through crafted HTTP requests to the gotoUrl parameter, affecting organizations relying on these devices for network connectivity. No vendor patch is currently available, leaving vulnerable routers exposed to availability disruptions; however, real-world exploitation interest remains minimal with very low EPSS score.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP management access to affected routers via firewall ACLs, implement network segmentation isolating router management traffic, disable remote management if not required, and monitor Tenda security advisories for patch release and updated firmware versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB