Shenzhen Tenda Technology Co., Ltd. disclosed a buffer overflow flaw in the hostname parameter of the formSetNetCheckTools function in its Tenda W15E router firmware version 15.11.0.10. The overflow occurs when an attacker sends a specially crafted HTTP request containing an overly long hostname, which can cause the router’s software to crash and become unresponsive. The vulnerability does not provide code execution or sensitive data exposure; it simply makes the device unavailable until re‑started, leading to a denial of service for users on the affected network.

The issue affects routers running the Tenda W15E firmware version 15.11.0.10. No other Tenda products or firmware revisions are listed as vulnerable. The flaw resides in the web‑based configuration interface of the device.

An attacker with network access to the router’s HTTP management interface can trigger the overflow by sending a malicious request to the formSetNetCheckTools endpoint. Because the vulnerability is triggered remotely, the risk is contingent on the router’s exposure to untrusted networks. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog; however, the CVSS metrics are not published, so the severity is judged as a high‑impact Denial of Service. Successfully exploited, the device would be inoperable, potentially disrupting network connectivity for all hosts on the network.