What is the CVSS score of CVE-2026-36819?

CVE-2026-36819 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W20E are affected by CVE-2026-36819?

Tenda W20E routers running firmware v15.11.0.6 contain a remote denial-of-service vulnerability accessible to any attacker with network access, enabling device crashes without authentication.

How to fix or mitigate CVE-2026-36819?

Within 24 hours: Inventory all Tenda W20E devices running firmware v15.11.0.6 and document their criticality (branch office, remote site, redundancy status). Within 7 days: Implement firewall rules restricting HTTP access to these routers (disable internet-facing management access); enable syslog if available. Within 30 days: Contact Tenda support for patch timeline; evaluate replacement with alternative vendor hardware; test any available firmware updates in isolated lab before production deployment.

Tenda W20E CVE-2026-36819

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:27 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W20E router firmware v15.11.0.6 allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules function. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflects easy network-based exploitation with high availability impact but no confidentiality or integrity loss, and no public exploit identified at time of analysis beyond a research repository reference.

Technical ContextAI

The Tenda W20E is an enterprise-grade wireless router whose web management interface processes DHCP rule configuration via the fromSetDhcpRules handler. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), meaning the bindMACAddr HTTP parameter is copied into a fixed-size stack buffer without proper length validation, corrupting the saved return address or adjacent stack frame data. Tenda SOHO/SMB routers have a long history of similar unauthenticated stack overflows in their httpd/goahead-based web interfaces, where userspace input handlers frequently use unsafe string operations like strcpy or sprintf on attacker-controlled query parameters. The CPE data in the input is unpopulated (cpe:2.3:a:n/a:n/a:*) so the affected scope must be derived from the description: firmware build v15.11.0.6 on the W20E hardware platform.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory or fixed firmware in the supplied references. As compensating controls, disable remote/WAN-side access to the router's web management interface (Tenda calls this 'Remote Web Management' under System Tools) so the fromSetDhcpRules endpoint is unreachable from the internet - this prevents external exploitation at the cost of losing remote admin convenience. Restrict LAN-side access to the management UI to a dedicated admin VLAN or specific source IPs via ACL where the device supports it, accepting that internal users on the same broadcast domain may still reach the endpoint. Monitor the third-party reference at https://github.com/xhh0124/SemVulLLM/tree/main/W20E/fromSetDhcpRules and Tenda's security page for a firmware release post-dating v15.11.0.6, and consider replacing end-of-support W20E units with a supported platform if Tenda does not issue a fix.