Tenda W20E
CVE-2026-36823
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed W20E management interface
-
DeliveryCraft HTTP POST with oversized webAuthUserInfo
-
ExploitSend request to formAddWebAuthUser endpoint
-
ExecutionOverflow stack buffer in httpd
-
PersistCrash management process
-
ImpactDeny router web administration and auth
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the W20E's HTTP management interface (TCP 80/443 by default) and the ability to send an HTTP request to the formAddWebAuthUser handler with an oversized webAuthUserInfo parameter; no authentication, user interaction, or special configuration is required, matching the AV:N/AC:L/PR:N/UI:N vector. Limiting factors in realistic deployments: the management interface is typically bound to the LAN side by default, so external exploitation depends on the operator having enabled WAN/remote management or otherwise exposing port 80/443 to untrusted networks, and only firmware v15.11.0.6 is explicitly confirmed vulnerable. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) signals a network-reachable, low-complexity, unauthenticated attack with availability-only impact, which is consistent with a DoS rather than code execution - the description explicitly limits impact to DoS, even though stack buffer overflows on embedded devices can sometimes be escalated. No EPSS score, KEV listing, or SSVC decision data was supplied, so prioritization must rely on CVSS plus deployment context: a W20E with its admin interface exposed to untrusted networks is at meaningful risk, while a LAN-only management interface limits realistic exposure. The referenced GitHub repository (SemVulLLM) suggests a researcher PoC trigger rather than a weaponized exploit, and there is no evidence of active exploitation. Note the CPE entry is the placeholder cpe:2.3:a:n/a:n/a:* rather than a proper Tenda CPE, so automated inventory tools may fail to flag affected devices - this is a data-quality gap defenders should be aware of. |
| Exploit ScenarioDerived | An attacker on the same network segment as the router's management interface - or on the internet, if remote management is enabled - sends a single crafted HTTP POST to the formAddWebAuthUser endpoint with an oversized webAuthUserInfo parameter, overflowing a stack buffer in the httpd process. The httpd worker crashes, dropping the web authentication portal and management UI and, depending on the device's process supervision, potentially forcing a reboot that disrupts client connectivity. A trigger PoC is publicly documented in the SemVulLLM GitHub repository, lowering the effort required to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. No public exploit identified at time of analysis, though a researcher-published proof-of-concept repository on GitHub documents the issue. EPSS and KEV data are not provided, but the network-reachable, no-auth, no-interaction CVSS vector makes this a credible risk for any exposed management interface.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware in the data provided, so administrators should monitor https://www.tendacn.com for a firmware update addressing CVE-2026-36823 and apply it as soon as available. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or specific admin IPs via ACL or firewall rules so the formAddWebAuthUser endpoint is not reachable from untrusted networks (trade-off: legitimate remote administration must be performed via VPN); disable remote/WAN-side management if currently enabled (trade-off: loss of off-site management convenience); and where the W20E is deployed at internet edge, consider replacing it with a model receiving active vendor support, since Tenda SOHO/SMB routers have a history of unpatched webserver flaws. Reference the researcher PoC at https://github.com/xhh0124/SemVulLLM/tree/main/W20E/formAddWebAuthUser to build IDS/IPS signatures matching oversized webAuthUserInfo values in POSTs to formAddWebAuthUser.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W20E is an enterprise-class wireless router produced by Shenzhen Tenda Technology, with a web-based administrative interface implemented in the device's embedded HTTP server (typically httpd/goahead-derived on MIPS or ARM). The vulnerable formAddWebAuthUser handler processes user-management requests and reads the webAuthUserInfo parameter into a fixed-size stack buffer without adequate bounds checking, matching CWE-121 (Stack-based Buffer Overflow). On embedded Linux routers of this class, such overflows typically corrupt the saved return address or adjacent stack metadata, causing the httpd process to crash and the captive web-auth/management functions to become unavailable until the device reboots or the watchdog restarts the service.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
Tenda W20E router firmware v15.11.0.6 is vulnerable to a remotely exploitable denial-of-service attack, with publicly available exploit code identified. Unauthenticated attackers can crash the device without user interaction, disrupting network operations for any organization using this model. Immediate containment and vendor engagement are required to reduce operational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement firewall rules restricting management interface access to internal, trusted networks only; (2) Disable remote management if operationally feasible; (3) Deploy network segmentation isolating router management traffic from untrusted sources; (4) Enable detailed logging of management interface access attempts and alert on abnormal traffic patterns; (5) Monitor for suspicious HTTP requests targeting the webAuthUserInfo endpoint; (6) Consider deploying web application firewall rules to block malformed requests to that parameter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB