Executive brief
The Tenda W15E enterprise router contains a security flaw in its web management interface. An attacker can send a specially crafted network request to the device to cause it to crash or become unresponsive. This results in a denial-of-service condition, disrupting internet connectivity and local network operations for all connected users.
Technical details
A stack-based buffer overflow exists in the Tenda W15E v15.11.0.10 firmware within the 'formAddWebAuthUser' function. The vulnerability is triggered when the 'webAuthUserInfo' (or 'webAuthUserPwd' as referenced in some descriptions) parameter is processed. Specifically, the code uses 'websGetVar' to retrieve user input and then performs a 'strncpy' operation into a fixed-size 'temp' buffer without adequate bounds checking, using a length calculated by 'strchr' finding a newline character. An attacker can exploit this by sending a crafted HTTP request to the 'addWebAuthUser' action with a long string followed by a newline, leading to a process crash and Denial of Service (DoS).
Affected products
- Tenda W15E v15.11.0.10
Timeline
- 2026-03-18: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure via GitHub repository
- 2026-06-09: advisory: NVD published CVE-2026-36807