A buffer overflow exists in the webAuthUserPwd parameter of the formModifyWebAuthUser function in Shenzhen Tenda Technology Co., Ltd Tenda W15E firmware 15.11.0.10. When an attacker sends a specially crafted HTTP request, the overflow can corrupt memory and cause the web service to crash, interrupting normal router operation. The vulnerability is a classic out‑of‑bounds memory write that leads to a service crash rather than arbitrary code execution.

The affected product is the Tenda W15E router running firmware version 15.11.0.10. No other vendors or product versions are listed as affected.

The exploit can be performed remotely by any entity with network access to the router’s web management interface, using a crafted HTTP request to the webAuthUserPwd field. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a public fix coupled with the ease of triggering the overflow indicates a moderate to high risk for nearby networks. The vulnerability is not listed in the CISA KEV catalog, but the defensive posture should treat it with the same urgency as any unpatched buffer overflow that can cause service disruption.