CVE-2026-36806
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the webAuthUserPwd parameter of the formModifyWebAuthUser function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
Risk Assessment
The risk is the potential remote shutdown of the device, which can disrupt network operations and impact service availability.
Recommendation
It is recommended to immediately update the Tenda W15E router firmware to the latest version if a patch is available from the vendor.
Other vulnerabilities in Tenda W15E
See all- CVE-2017-14514High
Directory Traversal vulnerability on Tenda W15E devices before version 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL.
- CVE-2026-36817High
A buffer overflow vulnerability was discovered in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function in Tenda W15E router version 15.11.0.10. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36816High
A buffer overflow vulnerability was discovered in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function in Tenda W15E router version 15.11.0.10. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36815High
A buffer overflow vulnerability was discovered in the hostname parameter of the formSetNetCheckTools function in Tenda W15E router version 15.11.0.10. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36813High
A buffer overflow vulnerability was discovered in the picCropName parameter of the formCropAndSetWewifiPic function in Tenda W15E router version 15.11.0.10. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36811High
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the picName parameter of the formDelwebAuthPic function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36810High
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the gotoUrl parameter of the formPortalAuth function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36809High
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36808High
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the webAuthUserInfo parameter of the formAddWebAuthUser function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36807High
A buffer overflow vulnerability was discovered in the Tenda W15E router version 15.11.0.10 in the webAuthUserPwd parameter of the formAddWebAuthUser function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
Original NVD description (English source)
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formModifyWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.