What is the CVSS score of CVE-2026-36823?

CVE-2026-36823 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W20E are affected by CVE-2026-36823?

Tenda W20E router firmware v15.11.0.6 is vulnerable to a remotely exploitable denial-of-service attack, with publicly available exploit code identified.

How to fix or mitigate CVE-2026-36823?

24 hours: Inventory all Tenda W20E devices running firmware v15.11.0.6 and assess network exposure (internet-facing, management network accessibility). Implement firewall rules to restrict HTTP/HTTPS access to the management interface (ports 80/443) to authorized internal networks only. 7 days: Contact Tenda support for patch timeline and evaluate alternative firmware versions or hardware compatibility. 30 days: Deploy patched firmware as soon as released by vendor; if no patch is forthcoming within 90 days, plan replacement of affected devices.

Tenda W20E CVE-2026-36823

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Tenda Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:20 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. No public exploit identified at time of analysis, though a researcher-published proof-of-concept repository on GitHub documents the issue. EPSS and KEV data are not provided, but the network-reachable, no-auth, no-interaction CVSS vector makes this a credible risk for any exposed management interface.

Technical ContextAI

The Tenda W20E is an enterprise-class wireless router produced by Shenzhen Tenda Technology, with a web-based administrative interface implemented in the device's embedded HTTP server (typically httpd/goahead-derived on MIPS or ARM). The vulnerable formAddWebAuthUser handler processes user-management requests and reads the webAuthUserInfo parameter into a fixed-size stack buffer without adequate bounds checking, matching CWE-121 (Stack-based Buffer Overflow). On embedded Linux routers of this class, such overflows typically corrupt the saved return address or adjacent stack metadata, causing the httpd process to crash and the captive web-auth/management functions to become unavailable until the device reboots or the watchdog restarts the service.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware in the data provided, so administrators should monitor https://www.tendacn.com for a firmware update addressing CVE-2026-36823 and apply it as soon as available. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or specific admin IPs via ACL or firewall rules so the formAddWebAuthUser endpoint is not reachable from untrusted networks (trade-off: legitimate remote administration must be performed via VPN); disable remote/WAN-side management if currently enabled (trade-off: loss of off-site management convenience); and where the W20E is deployed at internet edge, consider replacing it with a model receiving active vendor support, since Tenda SOHO/SMB routers have a history of unpatched webserver flaws. Reference the researcher PoC at https://github.com/xhh0124/SemVulLLM/tree/main/W20E/formAddWebAuthUser to build IDS/IPS signatures matching oversized webAuthUserInfo values in POSTs to formAddWebAuthUser.