A buffer overflow occurs in the gotoUrl parameter of the formPortalAuth function in the firmware of the Shenzhen Tenda Technology Co., Ltd Tenda W15E router running version 15.11.0.10. Overly large input values are not properly validated, causing the service to crash and the device to reboot or become unresponsive. This results in a denial of network connectivity for any host relying on the affected router.

The vulnerability affects Shenzhen Tenda Technology Co., Ltd Tenda W15E network appliances with firmware 15.11.0.10. No other versions or products are listed in the current record.

The flaw is exploitable over the network through a crafted HTTP request directed at the formPortalAuth endpoint. While no official CVSS score or EPSS value is available, the attack vector is clear and the impact is complete service disruption. The vulnerability is not registered in CISA’s Known Exploited Vulnerabilities catalog, but a DoS can be achieved without additional privileges.