A buffer overflow was discovered in the webAuthUserInfo parameter of the formAddWebAuthUser function in Shenzhen Tenda Technology Tenda W20E v15.11.0.6. The flaw allows an attacker to overflow a memory buffer with a crafted HTTP request, causing the target process to crash and denying legitimate users access to the device's web interface. The immediate result is a denial of service without impacting confidentiality or integrity of stored data.

Shenzhen Tenda Technology Co., Ltd Tenda W20E routers running firmware version 15.11.0.6 are affected. No other vendor or product versions are listed as impacted from the available data.

Information on CVSS and EPSS scores is not provided, and the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is likely network-based, requiring an attacker to send a specially crafted HTTP request to the vulnerable endpoint. Successful exploitation leads to a service crash, which can be disruptive in environments where the router’s web interface is mission critical. The lack of reported exploitation data suggests the risk may be moderate, but the potential for downtime warrants immediate attention.