CVE-2026-36810: Tenda W15E Buffer Overflow Vulnerability

CVE-2026-36810 Overview

CVE-2026-36810 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda W15E routers running firmware version v15.11.0.10. The flaw exists in the gotoUrl parameter of the formPortalAuth function. Remote attackers can trigger a denial of service (DoS) condition by sending a crafted HTTP request to the affected device. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input) and requires no authentication or user interaction to exploit. Successful exploitation disrupts router availability, impacting any network relying on the device for connectivity.

Critical Impact
Unauthenticated remote attackers can crash the Tenda W15E router via a crafted HTTP request, causing network-wide denial of service.

Affected Products

Shenzhen Tenda Technology Co., Ltd Tenda W15E
Firmware version v15.11.0.10
Networks relying on the W15E as a gateway or portal authentication device

Discovery Timeline

2026-06-09 - CVE-2026-36810 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36810

Vulnerability Analysis

The vulnerability resides in the formPortalAuth handler exposed by the Tenda W15E web management interface. This handler processes captive portal authentication requests submitted over HTTP. When the function receives the gotoUrl parameter, it copies the attacker-controlled value into a fixed-size stack buffer without validating the input length. An overly long string overflows the buffer, corrupting adjacent memory and crashing the embedded HTTP service. Because the service runs as a core component of the router firmware, the crash propagates to the entire device, forcing a reboot or hang. The flaw is reachable over the network without credentials, which broadens the attack surface to any client able to reach the management interface.

Root Cause

The root cause is the absence of bounds checking when handling the gotoUrl HTTP parameter inside formPortalAuth. The function relies on unsafe string copy semantics typical of older embedded C codebases, where a destination buffer of a fixed size receives attacker-supplied data without prior length validation. This pattern aligns with [CWE-120], classic buffer copy without checking size of input.

Attack Vector

Exploitation requires the attacker to send a single crafted HTTP request targeting the portal authentication endpoint with an oversized gotoUrl value. The request can originate from any host with network reachability to the router's web interface, including LAN clients or, in misconfigured deployments, Internet-based attackers. No credentials, tokens, or user interaction are required. The result is loss of availability rather than code execution or data exposure, consistent with the CVSS impact profile (A:H, C:N, I:N).

No verified proof-of-concept code is reproduced here. Technical details and a PoC are referenced in the GitHub PoC Repository.

Detection Methods for CVE-2026-36810

Indicators of Compromise

Unexpected reboots or service interruptions on the Tenda W15E router
HTTP POST requests to portal authentication endpoints containing abnormally long gotoUrl parameter values
Repeated TCP resets or connection failures to the router's management interface
Loss of LAN connectivity correlated with inbound HTTP traffic to the router

Detection Strategies

Inspect HTTP traffic destined for the router for formPortalAuth requests with gotoUrl parameters exceeding expected URL length (commonly >256 bytes)
Deploy network IDS signatures that flag oversized query parameters targeting embedded device management interfaces
Correlate router availability monitoring data with HTTP request logs from upstream proxies or firewalls

Monitoring Recommendations

Enable uptime and ICMP availability monitoring on the W15E and alert on unexpected reboots
Log all administrative HTTP requests at the perimeter firewall for retrospective analysis
Monitor syslog output from the router for crash or watchdog-reset messages

How to Mitigate CVE-2026-36810

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs or specific administrative IP addresses
Disable WAN-side access to the HTTP management interface if currently exposed
Disable the captive portal feature on the W15E if it is not operationally required
Monitor the Tenda support portal for a firmware update addressing the formPortalAuth flaw

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry for CVE-2026-36810. Administrators should consult the Tenda product support page for firmware updates beyond v15.11.0.10 and apply them once available. Until a fix is released, network-level controls remain the primary mitigation.

Workarounds

Place the router behind an upstream firewall that filters HTTP requests with oversized gotoUrl parameter values
Apply ACLs limiting which client subnets can reach the portal authentication endpoint
Where feasible, replace the affected device with hardware that receives active security maintenance

bash

# Example iptables rule to restrict access to the router web interface to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP