What is the CVSS score of CVE-2026-36817?

CVE-2026-36817 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W15E are affected by CVE-2026-36817?

Tenda W15E router firmware v15.11.0.10 contains a remote denial-of-service vulnerability that allows unauthenticated attackers to crash devices via malformed HTTP requests, disrupting network…

How to fix or mitigate CVE-2026-36817?

Within 24 hours: Conduct asset inventory of all Tenda W15E routers in production and classify by criticality. Within 7 days: Escalate to Tenda support for patch ETA; implement network access restrictions to limit untrusted HTTP traffic to these devices and enable comprehensive logging of formAddWebAuthWhiteUser requests. Within 30 days: Develop hardware replacement or migration plan; contact Tenda for patch availability; deploy monitoring for exploitation indicators.

Tenda W15E CVE-2026-36817

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request to management interface (AV:N/AC:L/PR:N/UI:N), no confidentiality or integrity impact described, only daemon/device crash yields A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:24 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W15E router firmware v15.11.0.10 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser handler. EPSS is very low (0.02%, 4th percentile) and no public exploit identified at time of analysis, though a GitHub research repository documents the flaw. The CVSS 7.5 reflects high availability impact with no confidentiality or integrity compromise.

Technical ContextAI

The Tenda W15E is an enterprise/SMB wireless access controller and gateway whose web management interface exposes the formAddWebAuthWhiteUser endpoint, used to add users to a captive-portal/web-authentication whitelist. The webAuthWhiteUserInfo parameter is passed to a fixed-size stack or heap buffer without proper length validation, classic CWE-120 (Classic Buffer Overflow / unbounded copy). On Tenda SOHO/enterprise devices the httpd binary typically runs as root on a MIPS or ARM SoC, so overflowing this parameter corrupts adjacent memory and crashes the management daemon, taking the device's services offline until reboot. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a) rather than a proper vendor/product CPE, indicating the entry has not yet been fully enriched in NVD.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor https://www.tendacn.com/ for a firmware update superseding 15.11.0.10 for the W15E and apply it once published. As compensating controls, restrict access to the device's HTTP management interface to a dedicated management VLAN or trusted admin IPs via ACL - this eliminates remote unauthenticated reachability of formAddWebAuthWhiteUser at the cost of requiring admins to be on-network or VPN'd in. Disable WAN-side web administration if enabled (most Tenda devices expose this as a toggle), and place the device behind a reverse proxy or firewall that rate-limits or blocks oversized POSTs to /goform/formAddWebAuthWhiteUser; the trade-off is that legitimate large captive-portal whitelist updates may be truncated. If the web-authentication/captive-portal feature is not in use, disable it entirely to remove the vulnerable code path from runtime, accepting loss of guest-Wi-Fi auth functionality.