CVE-2026-36807 Overview
CVE-2026-36807 is a buffer overflow vulnerability affecting Shenzhen Tenda Technology Co., Ltd. Tenda W15E routers running firmware version v15.11.0.10. The flaw resides in the webAuthUserPwd parameter handled by the formAddWebAuthUser function. Remote attackers can send a crafted HTTP request to trigger memory corruption that causes a Denial of Service (DoS) condition on the device.
The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input). No authentication or user interaction is required to exploit the issue, and the attack is reachable over the network.
Critical Impact
Unauthenticated remote attackers can crash the Tenda W15E router by sending a single crafted HTTP request, disrupting network connectivity for all downstream clients.
Affected Products
- Shenzhen Tenda Technology Co., Ltd. Tenda W15E
- Firmware version v15.11.0.10
- formAddWebAuthUser function in the router web management interface
Discovery Timeline
- 2026-06-09 - CVE-2026-36807 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36807
Vulnerability Analysis
The vulnerability resides in the formAddWebAuthUser function exposed by the Tenda W15E web management interface. This handler processes HTTP POST requests used to add web authentication users to the router configuration. The function copies the value of the webAuthUserPwd HTTP parameter into a fixed-size stack or heap buffer without validating the length of the incoming data.
When an attacker submits an overly long webAuthUserPwd value, the copy operation writes past the bounds of the destination buffer. This corrupts adjacent memory, leading to a crash of the httpd process responsible for serving the management interface. Because the management daemon is typically integrated with core router services, the crash results in a Denial of Service for the entire device.
Root Cause
The root cause is missing input length validation in the formAddWebAuthUser handler. The function trusts the attacker-controlled webAuthUserPwd parameter and performs an unsafe string copy without enforcing a maximum size. This pattern is consistent with [CWE-120] buffer overflow weaknesses commonly found in embedded router firmware that uses unsafe C string functions such as strcpy or sprintf.
Attack Vector
An attacker on the same network segment as the router, or on the internet if the management interface is exposed, can issue a crafted HTTP request targeting the formAddWebAuthUser endpoint. The request includes a webAuthUserPwd parameter populated with a payload exceeding the expected buffer size. Successful exploitation crashes the management service and disrupts router operation until the device is rebooted. A public proof-of-concept is available in the GitHub PoC Repository.
Detection Methods for CVE-2026-36807
Indicators of Compromise
- Unexpected reboots or crashes of the Tenda W15E router with loss of management plane availability.
- HTTP POST requests targeting /goform/formAddWebAuthUser with abnormally long webAuthUserPwd parameter values.
- Repeated connection resets or timeouts to the router web administration interface following inbound HTTP traffic.
Detection Strategies
- Inspect HTTP traffic destined to the router management interface for requests to formAddWebAuthUser containing oversized parameter values.
- Apply intrusion detection signatures that flag HTTP POST bodies exceeding expected field lengths for known Tenda endpoints.
- Correlate router availability monitoring alerts with concurrent inbound HTTP traffic to identify probable exploitation attempts.
Monitoring Recommendations
- Enable logging on perimeter firewalls for any inbound traffic to TCP ports used by the Tenda W15E management interface.
- Monitor router uptime and management service availability with external health checks.
- Capture and review packet captures of administrative traffic to identify anomalous parameter sizes.
How to Mitigate CVE-2026-36807
Immediate Actions Required
- Restrict access to the Tenda W15E web management interface to trusted internal hosts using firewall ACLs.
- Disable remote (WAN-side) management of the router until a vendor patch is available.
- Change default administrative credentials and limit which users can reach the management endpoint.
Patch Information
No vendor advisory or patched firmware release has been published in the referenced sources at the time of this writing. Operators should monitor the Tenda support portal for an updated firmware build that addresses the formAddWebAuthUser buffer overflow. Until a fix is available, network-based mitigations are the primary defense.
Workarounds
- Place the router management interface on a dedicated management VLAN reachable only from administrative workstations.
- Use a network gateway or web application firewall to drop HTTP requests to formAddWebAuthUser containing oversized webAuthUserPwd values.
- Replace affected Tenda W15E devices with supported hardware if a vendor patch is not released in a timely manner.
# Example firewall rule to restrict access to the router management interface
# Replace 192.0.2.10 with your trusted admin workstation IP
# Replace 192.0.2.1 with the router management IP
iptables -A FORWARD -s 192.0.2.10 -d 192.0.2.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
