Shenzhen Tenda Technology’s Tenda W15E router version 15.11.0.10 has a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. An attacker can send a specially crafted HTTP request that overflows the buffer, causing the device to crash or become unresponsive. The primary impact is a denial of service, denying legitimate users access to the router's web interface and potentially disrupting network connectivity. The weakness is an improper restriction of operations within the bounds of a memory buffer.

This vulnerability is specific to the Tenda W15E router produced by Shenzhen Tenda Technology. The affected firmware version is 15.11.0.10, the only version mentioned in the advisory. If other firmware revisions exist, they have not been identified as affected.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known or actively exploited issue at this time. The attack vector is an externally reachable HTTP request to the formAddWebAuthWhiteUser endpoint, which can be executed from any network segment with access to the device. While the risk of denial of service exists, the likelihood of exploitation remains unclear due to the lack of public exploitation data.