What is the CVSS score of CVE-2026-36822?

CVE-2026-36822 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W20E are affected by CVE-2026-36822?

Tenda W20E routers running firmware v15.11.0.6 are vulnerable to unauthenticated remote denial-of-service attacks that crash affected devices, directly threatening network availability for…

How to fix or mitigate CVE-2026-36822?

Within 24 hours: Inventory all Tenda W20E routers deployed and confirm firmware versions; implement firewall rules blocking unauthenticated HTTP access to router management interfaces. Within 7 days: Contact Tenda support regarding v15.11.0.6 patch timeline; restrict management access via network ACLs and disable remote administration where operationally feasible; apply any interim firmware releases from Tenda. Within 30 days: Evaluate available Tenda firmware patches or plan hardware replacement strategy; implement network segmentation isolating affected routers from critical infrastructure; establish continuous monitoring for exploitation attempts.

Tenda W20E CVE-2026-36822

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:28 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDelStaState function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W20E router firmware v15.11.0.6 allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request containing an oversized macAddr parameter to the formDelStaState handler. The flaw is a stack-based buffer overflow with high availability impact and no confidentiality/integrity loss per CVSS, and no public exploit identified at time of analysis beyond a research repository on GitHub.

Technical ContextAI

The Tenda W20E is a small/medium-business gigabit VPN router whose embedded web management interface exposes CGI-like handlers in its HTTP daemon (httpd). The vulnerable formDelStaState function is responsible for removing wireless station state entries and parses a macAddr parameter from incoming HTTP requests. CWE-121 (Stack-based Buffer Overflow) indicates that the parameter is copied into a fixed-size stack buffer without proper length validation, allowing adjacent stack data - including saved return addresses - to be overwritten. On MIPS-based Tenda devices, such overflows typically corrupt the saved $ra register and crash the httpd worker, producing a denial of service. The single CPE entry (cpe:2.3:a:n/a:n/a) is a placeholder and does not enumerate exact affected hardware/firmware combinations.

RemediationAI

No vendor-released patch identified at time of analysis - Shenzhen Tenda has not published an advisory or fixed firmware build referenced in the provided data, and administrators should monitor https://www.tendacn.com/ for a successor to v15.11.0.6. As compensating controls, disable remote (WAN-side) web administration on the W20E so the httpd is only reachable from trusted LAN segments, and restrict LAN access to the management interface (typically 192.168.0.1) via firewall rules or VLAN segmentation to a dedicated admin workstation, accepting the trade-off that legitimate admins must connect from that segment. Where feasible, place the device behind an upstream reverse proxy or WAF that enforces a strict allowlist on macAddr (canonical 17-character MAC format) for any forwarded requests to formDelStaState, noting this may break legitimate management traffic if the field is used elsewhere. Researcher proof-of-concept material is at https://github.com/xhh0124/SemVulLLM/tree/main/W20E/formDelStaState and can be used to validate any mitigation.