Executive brief
The Tenda W15E enterprise router is susceptible to a security flaw that can be triggered by sending a specifically formatted web request. An attacker can exploit this to crash the device's management service or cause the entire router to become unstable. This results in a denial of service, preventing legitimate users from accessing the network or managing the device.
Technical details
A buffer overflow vulnerability exists in the Tenda W15E router (v15.11.0.10) within the 'formSetNetCheckTools' function, which is registered to the 'setFixTools' action. The root cause is an unsafe memory operation where the 'hostname' parameter, retrieved via 'websGetVar', is copied into a fixed-size buffer using 'strncpy' with a length ('__n') derived directly from the user-supplied string's length ('strlen'). Because the destination buffer size is not validated against the source length, an attacker can provide an overly long hostname (e.g., 888+ characters) to overwrite adjacent memory. This can be triggered via a network-reachable HTTP request without specific authentication mentioned, leading to a process crash or device instability (Denial of Service).
Affected products
- Tenda W15E v15.11.0.10
Timeline
- 2026-03-18: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure
- 2026-06-09: advisory: NVD publication date