CVE-2026-36815: Tenda W15E Buffer Overflow DoS Vulnerability

CVE-2026-36815 Overview

CVE-2026-36815 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda W15E router firmware version v15.11.0.10. The flaw resides in the hostname parameter of the formSetNetCheckTools function. Attackers can send a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS) condition on the device. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires no authentication and no user interaction, and the attack is delivered over the network.

Critical Impact

Unauthenticated network attackers can crash the Tenda W15E router by sending a single crafted HTTP request, disrupting network availability for all connected users.

Affected Products

• Shenzhen Tenda Technology Co., Ltd Tenda W15E
• Firmware version v15.11.0.10
• formSetNetCheckTools web management function

Discovery Timeline

• 2026-06-09 - CVE-2026-36815 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36815

Vulnerability Analysis

The Tenda W15E router exposes a web management interface that processes administrative requests through CGI-style handlers. One such handler, formSetNetCheckTools, accepts a hostname parameter used by the network diagnostics feature. The function copies the user-supplied hostname value into a fixed-size stack buffer without validating the input length. When the attacker supplies a hostname value that exceeds the destination buffer size, adjacent stack memory is corrupted. The corruption causes the httpd process to crash, terminating the management interface and disrupting routing services. The vulnerability impacts availability only — confidentiality and integrity are not directly affected according to the published vector.

Root Cause

The root cause is missing bounds checking on the hostname HTTP parameter before it is copied into a stack-allocated buffer inside formSetNetCheckTools. The function relies on unsafe string-handling routines that do not enforce the destination buffer length, which aligns with the [CWE-120] classification.

Attack Vector

An unauthenticated remote attacker sends a single HTTP POST request to the router's web management endpoint with an oversized hostname parameter value. The crafted request triggers the overflow inside formSetNetCheckTools, crashing the httpd daemon and rendering the router unresponsive until it is rebooted. No credentials, prior access, or user interaction are required. A proof-of-concept demonstrating the parameter abuse is published in the GitHub PoC Repository.

Detection Methods for CVE-2026-36815

Indicators of Compromise

• Unexpected reboots or crashes of the Tenda W15E httpd web management process.
• Inbound HTTP POST requests targeting the formSetNetCheckTools endpoint with abnormally long hostname values.
• Loss of management-plane availability following receipt of crafted HTTP traffic from external or untrusted sources.

Detection Strategies

• Inspect HTTP request bodies and query strings for hostname parameter values that exceed expected lengths, such as values longer than 64 bytes.
• Correlate router reboot events with preceding HTTP requests to the network diagnostics endpoint in centralized logs.
• Deploy network IDS signatures that flag oversized POST parameters destined for Tenda W15E management interfaces.

Monitoring Recommendations

• Forward router syslog and crash data to a centralized log platform for correlation with network traffic captures.
• Alert on repeated availability loss of the W15E management interface, which may indicate exploitation attempts.
• Monitor for scanning activity probing Tenda-specific URL paths from untrusted networks.

How to Mitigate CVE-2026-36815

Immediate Actions Required

• Restrict access to the Tenda W15E web management interface so it is reachable only from trusted internal management networks.
• Disable remote (WAN-side) administration on the router until a vendor patch is applied.
• Apply network segmentation to isolate the router management plane from general user and guest traffic.

Patch Information

No vendor security advisory or fixed firmware version is referenced in the published CVE record at this time. Administrators should monitor Shenzhen Tenda Technology Co., Ltd. for an updated firmware release addressing the formSetNetCheckToolshostname parameter handling. The published reference for this issue is the GitHub PoC Repository.

Workarounds

• Place the router behind an upstream firewall that blocks unsolicited HTTP traffic to the management interface.
• Apply web application firewall or IPS rules that drop HTTP requests containing oversized hostname parameters destined for the device.
• Consider replacing affected W15E units with supported hardware if no vendor firmware fix becomes available.

# Example iptables rule restricting management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP