CVE-2026-36816: Tenda W15E Buffer Overflow DoS Vulnerability

CVE-2026-36816 Overview

CVE-2026-36816 is a buffer overflow vulnerability in the Shenzhen Tenda Technology Co., Ltd Tenda W15E router, firmware version v15.11.0.10. The flaw resides in the wewifiWhiteUserInfo parameter handled by the formAddWewifiWhiteUser function. Unauthenticated remote attackers can trigger the overflow by sending a crafted HTTP request. Successful exploitation causes a Denial of Service (DoS) condition on the affected device. The weakness is classified under CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact

Unauthenticated attackers can remotely crash the Tenda W15E router over the network by sending a single crafted HTTP request, disrupting wireless connectivity for all connected clients.

Affected Products

• Shenzhen Tenda Technology Co., Ltd Tenda W15E
• Firmware version v15.11.0.10
• formAddWewifiWhiteUser web management handler

Discovery Timeline

• 2026-06-09 - CVE-2026-36816 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36816

Vulnerability Analysis

The vulnerability exists in the formAddWewifiWhiteUser function of the Tenda W15E web management interface. This function processes the wewifiWhiteUserInfo HTTP request parameter, which controls entries in the WiFi whitelist user configuration. The handler copies attacker-controlled data into a fixed-size stack buffer without validating the input length. An oversized value supplied through this parameter overruns the buffer and corrupts adjacent memory on the device's MIPS-based runtime stack. The corrupted execution state causes the httpd web server process to crash, taking the device's management plane and dependent network services offline until reboot. A public proof-of-concept is referenced in the GitHub PoC Repository.

Root Cause

The root cause is the absence of bounds checking when copying the wewifiWhiteUserInfo parameter into a fixed-size buffer inside formAddWewifiWhiteUser. The function trusts the length of attacker-supplied input and uses an unsafe copy operation, matching the pattern described by CWE-120. Tenda SOHO routers commonly process such parameters through httpd CGI handlers without strict input validation, leaving them exposed to memory corruption from a single malformed request.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reachable on the router's HTTP management interface sends a POST request to the endpoint backed by formAddWewifiWhiteUser with an oversized wewifiWhiteUserInfo value. The crafted request triggers the overflow inside the request handler. The resulting crash forces the device to drop existing sessions and restart its web service or reboot. The vulnerability does not currently have evidence of active exploitation in the wild, and no CISA KEV listing exists.

No verified exploit code is published in the NVD reference set. Refer to the linked GitHub PoC repository for technical reproduction details.

Detection Methods for CVE-2026-36816

Indicators of Compromise

• Unexpected reboots or httpd service restarts on the Tenda W15E router without administrator action.
• HTTP POST requests targeting the formAddWewifiWhiteUser endpoint containing an unusually long wewifiWhiteUserInfo parameter value.
• Loss of management UI availability followed by automatic device recovery within a short interval.

Detection Strategies

• Inspect HTTP traffic destined for the router's management interface for requests referencing formAddWewifiWhiteUser and flag parameter lengths exceeding expected whitelist entry sizes.
• Correlate router availability drops with inbound HTTP requests from non-administrative sources using network telemetry and syslog data.
• Apply Snort or Suricata rules that match on the formAddWewifiWhiteUser URI combined with abnormal Content-Length headers.

Monitoring Recommendations

• Monitor SNMP uptime counters and syslog reboot events from the W15E for repeated unplanned restarts.
• Restrict and log all access to the router's HTTP management interface, alerting on requests originating from untrusted network segments.
• Track upstream network egress for scanning behavior targeting Tenda CGI endpoints across the environment.

How to Mitigate CVE-2026-36816

Immediate Actions Required

• Disable remote (WAN-side) HTTP and HTTPS management on the Tenda W15E until a vendor patch is available.
• Restrict access to the LAN-side management interface to a dedicated administrative VLAN or trusted host list.
• Audit the device for unauthorized configuration changes and reset administrative credentials.

Patch Information

No vendor patch or fixed firmware version is referenced in the NVD entry at publication. Monitor the Tenda official support site and the GitHub PoC Repository for updated firmware releases and additional technical detail. Apply firmware updates that supersede v15.11.0.10 once Tenda publishes them.

Workarounds

• Place the W15E behind an upstream firewall and block inbound TCP/80 and TCP/443 from untrusted networks.
• Disable WiFi whitelist (wewifi) management features through the UI if the deployment does not require them.
• Segment the router's management plane from production user networks and require VPN access for administration.
• Replace end-of-support Tenda SOHO devices with hardware that receives active security maintenance where feasible.

# Example: block external access to the router HTTP management interface on an upstream Linux gateway
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -m state --state NEW -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -m state --state NEW -j DROP

# Allow management only from an administrative subnet
iptables -I FORWARD -s 10.10.50.0/24 -d <ROUTER_IP> -p tcp --dport 443 -j ACCEPT