Shenzhen Tenda Technology’s Tenda W15E router firmware version 15.11.0.10 contains a buffer overflow that is triggered by sending a specially crafted HTTP request to the formAddWebAuthWhiteUser endpoint. The overflow occurs in the webAuthWhiteUserInfo parameter of that function, allowing an attacker to corrupt memory and crash the device, which results in a denial of service to all users of the router’s web interface. The weakness is a classic example of a buffer overflow (CWE-120).

The vulnerability affects only the Tenda W15E router produced by Shenzhen Tenda Technology, specifically firmware version 15.11.0.10. No other revisions or firmware versions are mentioned as affected in the advisory.

The EPSS score indicates a very low probability of exploitation (<1%), while the CVSS score of 7.5 classifies the issue as medium severity. The vulnerability is not listed in CISA KEV, suggesting it is not actively exploited. The attack vector is inferred from the description and is an externally reachable HTTP request to the formAddWebAuthWhiteUser endpoint, which can be sent from any network segment that can reach the device. Although denial of service is the primary risk, the likelihood of exploitation remains low according to the available metrics.