Shenzhen Tenda Technology’s W20E router firmware contains a buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules function. A crafted HTTP request can trigger the overflow and crash the device, resulting in a denial of service. This flaw is an example of improper handling of input buffers. The impact is a service outage for all devices connected to the affected router.

The vulnerability affects the Tenda W20E wireless router running firmware version 15.11.0.6. No other versions are listed in the advisory.

The vulnerability is remote, accessed over HTTP, and does not require authentication as described. EPSS data is unavailable and the issue is not listed in CISA KEV, indicating no documented exploitation yet. However, a buffer overflow can be triggered from any network that can reach the router’s HTTP API, making it potentially exploitable by adversaries with network access to the device.