CVE-2026-36808 Overview
CVE-2026-36808 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd. Tenda W15E routers running firmware version v15.11.0.10. The flaw resides in the webAuthUserInfo parameter handled by the formAddWebAuthUser function. A remote, unauthenticated attacker can send a crafted HTTP request to trigger memory corruption and cause a Denial of Service (DoS). The vulnerability is tracked under CWE-120: Classic Buffer Overflow.
Critical Impact
Unauthenticated attackers can remotely crash the Tenda W15E router over the network with a single malformed HTTP request, disrupting connectivity for all downstream users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd. Tenda W15E
- Tenda W15E firmware version v15.11.0.10
- Web management interface exposing the formAddWebAuthUser endpoint
Discovery Timeline
- 2026-06-09 - CVE-2026-36808 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in the NVD database
Technical Details for CVE-2026-36808
Vulnerability Analysis
The Tenda W15E is a small business wireless router with a web-based administration interface. The formAddWebAuthUser function processes requests intended to add web authentication users. This function reads the webAuthUserInfo parameter from the incoming HTTP request and copies it into a fixed-size memory buffer without validating the input length.
When an attacker supplies an oversized value for webAuthUserInfo, the copy operation writes beyond the bounds of the destination buffer. This corrupts adjacent memory on the stack or heap and crashes the httpd web server process. The router becomes unresponsive and stops serving traffic until rebooted. Because the request does not require authentication, exploitation is reachable from any host that can reach the management interface.
Root Cause
The root cause is missing length validation on user-controlled input before performing a memory copy. The formAddWebAuthUser handler trusts the size of the webAuthUserInfo parameter and does not enforce an upper bound. This pattern matches CWE-120: Buffer Copy without Checking Size of Input.
Attack Vector
Exploitation requires network access to the Tenda W15E HTTP management service. An attacker crafts a POST request to the formAddWebAuthUser endpoint with an excessively long webAuthUserInfo value. The malformed payload triggers the overflow, corrupting process memory and terminating the web service. No user interaction or credentials are required. A public proof-of-concept is available in the SemVulLLM GitHub repository.
Detection Methods for CVE-2026-36808
Indicators of Compromise
- HTTP POST requests to the router targeting formAddWebAuthUser containing unusually long webAuthUserInfo parameter values
- Repeated httpd process crashes or watchdog-triggered reboots on Tenda W15E devices
- Loss of management interface availability while the WAN link remains active
Detection Strategies
- Inspect inbound HTTP traffic to router management interfaces for parameter lengths exceeding expected bounds in formAddWebAuthUser requests
- Alert on patterns matching the public proof-of-concept payload structure in the SemVulLLM PoC
- Correlate router availability monitoring events with HTTP request logs to identify crash-inducing requests
Monitoring Recommendations
- Forward router syslog and crash telemetry to a centralized log platform for anomaly review
- Track availability of the device management interface and the upstream httpd service
- Monitor for unsolicited external connections to TCP ports hosting the router web UI
How to Mitigate CVE-2026-36808
Immediate Actions Required
- Restrict access to the Tenda W15E web management interface to trusted administrative networks only
- Disable remote WAN-side management on the device until a patched firmware version is available
- Apply firewall rules upstream that block external HTTP and HTTPS traffic destined for the router management ports
Patch Information
At the time of publication, no vendor advisory or firmware update from Shenzhen Tenda Technology Co., Ltd. has been linked to CVE-2026-36808 in the NVD record. Administrators should monitor the Tenda official support site for a firmware release addressing the formAddWebAuthUser buffer overflow and apply it as soon as it becomes available.
Workarounds
- Place the Tenda W15E behind a perimeter firewall that drops untrusted HTTP traffic to its management interface
- Bind the web management interface to the LAN only and disable any cloud or remote administration features
- Segment the router management VLAN and require VPN access for administrative tasks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
