A buffer overflow exists in the webAuthUserInfo parameter of the formAddWebAuthUser function in Shenzhen Tenda Technology Co., Ltd’s Tenda W15E firmware version 15.11.0.10. The overflow is triggered by crafting a specific HTTP request, and an attacker can exploit it to crash the web authentication service, resulting in a denial of service. The vulnerability does not disclose remote code execution or data leakage, but it can cause disruption of network management and access control for affected devices.

The flaw is present in the Tenda W15E router running firmware version 15.11.0.10. No other vendors or products are implicated by the current advisory. Users who operate this specific firmware revision should be aware of the risk.

This vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating limited information on public exploitation. The description states that attackers can trigger the bug by sending a crafted HTTP request to the webAuthUserInfo parameter; the need for authentication is not mentioned, so the likely attack vector is via an unauthenticated external HTTP request, but this is inferred rather than explicitly stated. The lack of remote code execution confines the impact to availability only. The CVSS score of 7.5 indicates a high severity. A successful exploit can crash the web authentication service, disrupting network management and access control for the affected device.