What is the CVSS score of CVE-2026-36816?

CVE-2026-36816 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36816?

Tenda W15E router firmware v15.11.0.10 contains a remotely exploitable denial-of-service vulnerability (CVE-2026-36816) allowing unauthenticated attackers to crash affected devices.

How to fix or mitigate CVE-2026-36816?

24 hours: Inventory all Tenda W15E routers and document firmware versions in use. 7 days: Implement firewall rules restricting unauthenticated HTTP access to router management interfaces and enable rate-limiting on inbound HTTP traffic. 30 days: Check Tenda security advisories for firmware updates to v15.11.0.11 or later; if unavailable, develop timeline for device replacement or alternative routing solutions.

Tenda W15E CVE-2026-36816

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP handler with low complexity; PR:L because router admin endpoints normally require a session, and impact is availability-only (DoS, no code execution claimed).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:24 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E router firmware v15.11.0.10 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that overflows a buffer in the wewifiWhiteUserInfo parameter handled by the formAddWewifiWhiteUser function. No public exploit identified at time of analysis, though a third-party research repository on GitHub references the vulnerable function, and EPSS is very low (0.02%, 4th percentile).

Technical ContextAI

The Tenda W15E is an enterprise/SMB wireless router. The flaw is a classic CWE-120 classic buffer copy without checking size of input (buffer overflow) in the device's HTTP-based web management interface. The formAddWewifiWhiteUser handler - part of a MAC/whitelist feature for WiFi access control - copies the user-supplied wewifiWhiteUserInfo parameter into a fixed-size stack or heap buffer without proper length validation, causing memory corruption that crashes the httpd/web management process. The CPE entry from MITRE is a placeholder ('cpe:2.3:a:n/a:n/a:*'), so version coverage beyond v15.11.0.10 must be inferred from the description alone.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory in the available references. Until a firmware update for the W15E is released, restrict access to the device's HTTP management interface so it is not reachable from the WAN or any untrusted LAN segment by placing it behind a management VLAN and ACLs (side effect: legitimate remote admin will require VPN). Disable or block external access to the WiFi whitelist endpoint specifically if the device supports per-feature ACLs, and monitor the httpd process for unexpected restarts. Track Tenda's product support page for W15E firmware newer than 15.11.0.10 and apply it immediately upon release; consider replacing end-of-life Tenda SMB hardware if the vendor does not respond, since multiple historic Tenda buffer overflows have gone unpatched.