What is the CVSS score of CVE-2026-36821?

CVE-2026-36821 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W20E are affected by CVE-2026-36821?

Tenda W20E routers running firmware v15.11.0.6 are vulnerable to remote denial-of-service attacks that require no authentication, creating a risk of unexpected network outages for organizations using…

How to fix or mitigate CVE-2026-36821?

Within 24 hours: Identify and inventory all Tenda W20E routers in the environment, determine firmware versions, and assess which are accessible from untrusted networks. Within 7 days: Implement network segmentation to restrict administrative interface access, disable remote HTTP administration where operationally feasible, and configure firewall rules to limit access to authorized management networks only. Within 30 days: Establish a device replacement roadmap; monitor Tenda security advisories for patch availability and evaluate alternative router models to eliminate exposure.

Tenda W20E CVE-2026-36821

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:28 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. No public exploit identified at time of analysis, though a research write-up referencing the vulnerable function exists in a public GitHub repository. The combination of network-reachable attack surface, no authentication requirement, and low complexity makes opportunistic abuse against exposed admin interfaces realistic.

Technical ContextAI

The Tenda W20E is an enterprise-grade dual-band wireless router whose web administration interface is implemented in a CGI-style binary that exposes form handlers such as formCropAndSetWewifiPic, used to process Wi-Fi picture/branding uploads. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), meaning the picCropName parameter from the inbound HTTP request is copied into a fixed-size stack buffer without proper length validation, corrupting adjacent stack memory including the saved return address. The provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and does not identify the device, so affected-product enumeration must rely on the vendor and version named in the description (Tenda W20E firmware v15.11.0.6) rather than NVD CPE data.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory in the provided references, so operators of W20E firmware v15.11.0.6 should check https://www.tendacn.com/ for any newer firmware release and apply it once available. As compensating controls, restrict access to the router's web management interface to trusted management VLANs or specific admin workstations via ACLs on the WAN and LAN sides (trade-off: legitimate remote administration is blocked), disable remote/WAN management entirely if currently enabled (trade-off: requires on-site or VPN access for changes), and place the device behind an upstream reverse proxy or WAF that can enforce length limits on the picCropName parameter for requests to formCropAndSetWewifiPic (trade-off: adds operational complexity and may not be feasible for SOHO deployments). If the device's role permits, consider replacing it with a supported model, since unpatched embedded routers frequently accumulate further unfixed flaws.