CVE-2026-36811: Shenzhen Tenda Technology Co

Synopsis

A stack-based buffer overflow in Tenda W15E firmware (v15.11.0.10) affects the picName parameter of the formDelwebAuthPic function. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable from the internet. Successful exploitation crashes the affected device, causing a denial of service. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as the upstream vendor publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the device to trigger the overflow.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated request carrying the malformed picName parameter is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted HTTP request directly to the device without any involvement from a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access to the device.

Blast Radius

• Crashes the affected Tenda W15E device, taking it offline and disrupting all network traffic it handles.
• Persistent or repeated exploitation can keep the device in a denial-of-service state, blocking connectivity for all users routed through it.
• No confidentiality or data-integrity impact is indicated; the attacker cannot read or modify stored data through this vulnerability.