What is the CVSS score of CVE-2026-36818?

CVE-2026-36818 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda W20E are affected by CVE-2026-36818?

Tenda W20E router devices in your network could be remotely disabled by attackers, potentially causing network outages if these routers are critical to operations.

How to fix or mitigate CVE-2026-36818?

Within 24 hours: Inventory all Tenda W20E devices running firmware v15.11.0.6 and classify by criticality to network continuity. Within 7 days: Restrict management interface access through network segmentation and deploy IDS/WAF rules to block malformed HTTP requests targeting the wewifiWhiteUserInfo parameter. Within 30 days: Monitor Tenda security advisories for patch availability; develop replacement strategy for affected devices in critical network functions.

Tenda W20E CVE-2026-36818

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request with no user interaction crashes the router (A:H); no confidentiality or integrity impact and scope unchanged within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:25 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Remote denial of service in Tenda W20E router firmware v15.11.0.6 allows unauthenticated network attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the wewifiWhiteUserInfo parameter handled by the formAddWewifiWhiteUser function. EPSS scores exploitation probability at only 0.02% (4th percentile) and no public exploit code or active exploitation has been reported, though a research repository documenting the finding exists on GitHub. The vulnerability is not listed in CISA KEV.

Technical ContextAI

The Tenda W20E is a small-business/enterprise wireless gateway whose web management interface exposes form handlers such as formAddWewifiWhiteUser, used to manage a whitelist of permitted Wi-Fi users. The flaw maps to CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input): the wewifiWhiteUserInfo HTTP parameter is copied into a fixed-size stack or heap buffer without proper bounds validation, allowing an oversized value to corrupt adjacent memory and crash the httpd process. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not include a vendor/product identifier, so affected scope must be derived from the description (W20E v15.11.0.6) rather than from authoritative CPE matching.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware in the supplied data, so the primary action is to monitor https://www.tendacn.com for an updated W20E firmware build that supersedes v15.11.0.6 and apply it once available. As compensating controls, ensure the device's web management interface is not exposed to the WAN (disable any remote-management option), restrict HTTP/HTTPS access to the management LAN segment via ACLs or firewall rules so that only trusted administrative hosts can reach the formAddWewifiWhiteUser endpoint, and consider placing the router behind an upstream device that can rate-limit or filter oversized POST parameters; the trade-off is loss of remote administration convenience and potential interference with legitimate large form submissions. Operators should also subscribe to vendor security notifications and consider replacing end-of-life W20E units if no fix materializes. Reference: https://github.com/xhh0124/SemVulLLM/tree/main/W20E/formAddWewifiWhiteUser for technical detail.