What is the CVSS score of CVE-2026-36810?

CVE-2026-36810 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36810?

A denial-of-service vulnerability in Tenda W15E v15.11.0.10 routers allows unauthenticated remote attackers to trigger network outages through crafted HTTP requests to the gotoUrl parameter,…

How to fix or mitigate CVE-2026-36810?

24 hours: Inventory all Tenda W15E v15.11.0.10 routers in the network and document business-critical dependencies. 7 days: Implement firewall rules restricting HTTP access to router management interfaces; check Tenda's security advisory page for firmware updates or workarounds. 30 days: Evaluate upgrade to patched firmware versions (contact Tenda for availability timeline) or consider replacement with routers from vendors with active security support.

Tenda W15E CVE-2026-36810

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request to portal handler (AV:N/AC:L/PR:N/UI:N); confirmed impact is httpd crash only, so C:N/I:N/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:23 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the gotoUrl parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E v15.11.0.10 routers can be triggered by remote unauthenticated attackers sending a crafted HTTP request that overflows the gotoUrl parameter in the formPortalAuth function. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and at the time of analysis no public exploit identified at time of analysis though a proof-of-concept research repository is referenced. EPSS is very low (0.02%, 4th percentile), suggesting limited real-world exploitation interest despite the network-reachable attack surface.

Technical ContextAI

The Tenda W15E is a small-business wireless access point/router with a captive portal authentication web interface. The vulnerable formPortalAuth handler is part of the device's embedded HTTP server (commonly httpd/goahead-derived in Tenda firmware) which processes portal authentication requests. The gotoUrl parameter - typically used to redirect users after portal login - is copied into a fixed-size stack buffer without proper bounds checking, matching CWE-120 (Classic Buffer Overflow). On the MIPS/ARM embedded targets typical for Tenda devices, oversized input corrupts the stack frame and crashes the httpd process, producing a denial of service; the CVSS vector (C:N/I:N/A:H) indicates impact is limited to availability rather than code execution in this assessment.

RemediationAI

No vendor-released patch identified at time of analysis - Shenzhen Tenda has not published an advisory or fixed firmware version in the available references. Operators should check the Tenda support portal (tendacn.com) for a firmware update newer than v15.11.0.10 and apply it once available. As compensating controls, restrict access to the device's HTTP management and captive portal interfaces to trusted management VLANs by configuring upstream ACLs or the device's own remote-management lockdown (trade-off: portal users on the LAN side may still reach the endpoint); if the captive portal feature is not used, disable it entirely in the W15E web UI to remove the vulnerable formPortalAuth code path (trade-off: loses guest authentication functionality); and place the device behind a reverse proxy or firewall that rate-limits and length-limits the gotoUrl query parameter (trade-off: requires inline infrastructure and may break legitimate long redirect URLs).