A buffer overflow occurs in the webAuthUserPwd parameter within the formModifyWebAuthUser function of Shenzhen Tenda Technology’s Tenda W15E firmware 15.11.0.10. When a crafted HTTP request is sent, the overflow corrupts memory on the device, causing the web service to crash and the router to stop responding. The flaw is a classic out‑of‑bounds write (CWE‑121) that results only in a service interruption rather than code execution.

The vulnerability affects the Tenda W15E router running firmware version 15.11.0.10. No other vendors or product versions are listed as affected.

The flaw can be triggered remotely by any entity with network access to the router’s web management interface using a malicious HTTP request. The EPSS score is < 1 %, indicating a very low but non‑zero exploitation probability. The CVSS score of 7.5 reflects the high impact on availability. The vulnerability is not listed in the CISA KEV catalog, so the router should be treated as having a high‑severity out‑of‑band memory‑corruption flaw that can disrupt network services.