Shenzhen Tenda Technology’s W15E router firmware version 15.11.0.10 contains a buffer overflow in the picName parameter of the formDelwebAuthPic handler. The overflow occurs when an attacker sends an HTTP request with an unusually large picName value, which causes the router’s web interface to crash and become unavailable. Because the flaw does not enable code execution or privilege escalation, its effect is limited to an availability disruption.

The affected device is the Tenda W15E router running firmware 15.11.0.10. No other devices or firmware revisions are currently identified as vulnerable in the publicly available information.

The flaw requires the attacker to access the router’s HTTP interface, so the most plausible attack vector is a remote attacker crafting a malicious request from outside the local network. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been documented yet. Nevertheless, a buffer overflow is a reliable method for causing a service crash, presenting a high‑severity denial of service risk to any owner of the affected device.