What is the CVSS score of CVE-2026-36820?

CVE-2026-36820 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W20E are affected by CVE-2026-36820?

Tenda W20E routers running firmware v15.11.0.6 are vulnerable to remote denial-of-service attacks that can crash the device without user authentication, creating immediate risk of network outages…

How to fix or mitigate CVE-2026-36820?

24 hours: Conduct inventory audit to identify all Tenda W20E devices in production and document firmware versions; isolate affected units from public internet access where operationally feasible. 7 days: Deploy firewall rules to rate-limit or block HTTP requests to affected routers; implement network segmentation to contain impact if exploitation occurs. 30 days: Contact Tenda to confirm availability of firmware versions beyond v15.11.0.6 or plan phased replacement with alternative router models; document compensating controls effectiveness.

Tenda W20E CVE-2026-36820

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:28 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. No public exploit identified at time of analysis, though a research repository documenting the flaw is referenced. The CVSS 7.5 (High) score reflects pure availability impact with no confidentiality or integrity loss.

Technical ContextAI

The Tenda W20E is an enterprise-grade wireless router whose web management interface exposes a CGI-style handler named formAddWebAuthWhiteUser, used to add users to the captive-portal/web-authentication whitelist. The flaw is classified as CWE-121 (Stack-Based Buffer Overflow), meaning a fixed-size stack buffer is populated from the webAuthWhiteUserInfo HTTP parameter without proper length validation. On embedded MIPS/ARM Tenda firmware lineage, this handler is implemented in the httpd binary and is reachable through the LAN-side management HTTP server, where overflowing the stack frame corrupts the saved return address and crashes the web/management daemon, breaking router administration and frequently the routing data plane that shares the process tree.

RemediationAI

No vendor-released patch identified at time of analysis - no Tenda security advisory or fixed firmware version is referenced in the available data, so users should monitor https://www.tendacn.com for a W20E firmware update superseding 15.11.0.6 and apply it once available. As compensating controls, disable remote (WAN-side) HTTP/HTTPS management entirely to remove Internet exposure (side effect: administrators must be on the LAN or VPN to manage the device), restrict access to the management interface to a dedicated admin VLAN or specific source IPs via ACL (side effect: breaks ad-hoc support workflows), and place the device behind an upstream firewall or IPS with rules that drop oversized or malformed POST bodies to /goform/formAddWebAuthWhiteUser. For high-availability environments, treat the W20E as end-of-support if Tenda does not respond and plan migration to a vendor with an active PSIRT process; the referenced research artifact at https://github.com/xhh0124/SemVulLLM/tree/main/W20E/formAddWebAuthWhiteUser can inform detection signatures.