CVE-2026-36818: Shenzhen Tenda Technology Co

Synopsis

A stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.6) allows an unauthenticated attacker to crash the device by sending a crafted HTTP request targeting the wewifiWhiteUserInfo parameter in the formAddWewifiWhiteUser function. The vulnerability is reachable over the network with no login required and no user interaction needed. Successful exploitation causes a Denial of Service, taking the affected router offline. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP endpoint must be reachable over the network; an attacker sends a crafted HTTP request directly to the device without needing any prior foothold.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the overflow.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the target device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply supplies an oversized value in the wewifiWhiteUserInfo parameter and the crash is deterministic.

Blast Radius

• Crashes the Tenda W20E router process, dropping all network traffic routed through the device.
• Takes the affected device offline until it is manually rebooted or automatically restarts, causing a full service outage for connected clients.
• Enables repeated denial-of-service loops if the attacker continuously sends crafted requests after each restart.