Tenda W20E CVE-2026-36821

Network reachability to the Tenda W20E web administration interface (typically TCP/80 or TCP/443) on a device running firmware v15.11.0.6, and the ability to send an HTTP request to the formCropAndSetWewifiPic handler with an attacker-controlled picCropName parameter. Per CVSS PR:N/UI:N, no authentication or user interaction is required, and AC:L indicates no special timing or configuration prerequisites. Exploitation is limited by whether the management interface is reachable from the attacker's position - devices that expose admin only on the LAN restrict the attacker to internal or Wi-Fi-adjacent positions, while devices with WAN-side management enabled are exposed to the internet.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and accurately reflects a remote, unauthenticated, low-complexity attack whose only impact is availability - confidentiality and integrity are unaffected, consistent with the description's DoS-only outcome despite the underlying stack overflow being a class of bug that often enables RCE on embedded MIPS/ARM targets. No EPSS score, KEV listing, SSVC decision, or vendor advisory was supplied, and the sole reference is a third-party LLM-vulnerability-research repository rather than a working PoC or vendor confirmation, so exploitation likelihood signals are absent. Real-world risk depends heavily on whether the W20E web UI is exposed to untrusted networks: internet-exposed devices face credible drive-by DoS, while LAN-only deployments face minimal risk unless an attacker has already pivoted internally; the possibility that the stack overflow is exploitable beyond DoS (full RCE) cannot be ruled out from available data and should be assumed until vendor analysis confirms otherwise.

An attacker who can reach the W20E web management interface - for example, a guest on the same Wi-Fi network or any internet host if WAN administration is exposed - sends a single crafted HTTP request to the formCropAndSetWewifiPic endpoint with an oversized picCropName value, overflowing the stack buffer and crashing the httpd process. The router reboots or becomes unreachable, dropping all wireless and routed traffic and producing a sustained outage if the request is replayed in a loop.