Shenzhen Tenda Technology’s W15E router firmware version 15.11.0.10 contains a buffer overflow in the picName parameter of the formDelwebAuthPic handler. A crafted HTTP request with an oversized payload can trigger the overflow, causing the web interface to crash and rendering the device unavailable. The vulnerability is an out‑of‑bounds write and does not affect authentication or privilege levels; its effect is limited to availability disruption.

The affected device is the Tenda W15E router running firmware 15.11.0.10. No other versions or variants were identified in the available data.

The flaw requires direct network access to the router’s HTTP interface, so the most likely attack vector is a remote attacker sending a malicious request. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been documented. Nonetheless, a buffer overflow can reliably crash the service, presenting a high‑severity denial of service risk for any user owning such a device.